JWT Decoder and Verifier
Decode a JSON Web Token, read its claims in plain English, check whether it has expired, and verify the signature — all locally, so you can paste real tokens.
Header · Payload · Signature
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4OTg0NzE5OSwiZXhwIjoyMTA1MjA3MTk5LCJpc3MiOiJodHRwczovL2RldnRvb2xzLmV4YW1wbGUiLCJhdWQiOiJkZXZ0b29scy1odWIifQ.bvcLioPubHAJdfNF1gTome5FPtM3YLdKFN1NUZgLe3M
Signature
HS256Checked in your browser — the secret is never sent anywhere. Only a public key is needed for RS and ES tokens.
subSubject1234567890
Who the token is about — usually a user ID.
namecustomAda Lovelace
rolecustomadmin
iatIssued at1789847199
2026-09-19 19:46:39 UTC
When the token was created.
expExpires at2105207199
2036-09-16 19:46:39 UTC
After this moment the token must be rejected.
issIssuerhttps://devtools.example
Who created and signed this token.
audAudiencedevtools-hub
Who the token is intended for.
What the JWT Decoder does
- Decodes the header and payload of a JSON Web Token and shows the three segments separately.
- Explains registered claims in plain English and converts timestamp claims into readable dates.
- Tells you whether the token is currently valid, expired, or not yet usable.
- Verifies signatures in your browser — HS256/384/512 with a shared secret, RS and ES with a public key.
What it doesn't do
- It doesn't create or sign tokens.
- It doesn't fetch keys from a JWKS endpoint — paste the key you want to check against.
- It doesn't tell you whether a token has been revoked, which only the issuing system knows.
Frequently asked questions
Is it safe to paste a real token here?
Decoding and verification happen entirely in your browser, and the secret or key you enter is deliberately kept out of the page URL. The token itself does go into the URL so the view can be shared, so treat a shared link as containing the token. For a production token that's still live, prefer to test with one that has expired.
Is a JWT encrypted?
No, and this is the most common misunderstanding. The header and payload are only Base64url encoded, which anyone can reverse — this page does it without any key. The signature proves the token wasn't altered; it does not hide the contents. Never put secrets in a JWT payload.
What does "alg: none" mean?
It means the token is unsigned, so anyone can change its contents. It exists in the specification but accepting it is a well-known vulnerability — any system that honours such a token is trusting unverified data.
Why does verification fail when the token looks fine?
Usually the wrong key, or the wrong kind of key. HS algorithms need the exact shared secret, including any trailing whitespace. RS and ES need the public key, not the private one, in PEM or JWK form. A token that has been altered by even one character will also fail.