JWT Decoder & Verifier
Free JWT decoder and verifier — decode the header and payload of a JSON Web Token, read its registered claims, and verify the signature against an HMAC secret or a public key. Runs entirely in your browser; a token is a live credential and is never uploaded.
Verify the signature
Shared secret for HS*, or the issuer's public key in PEM for RS*,PS*, ES* and EdDSA.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Decode and verify a JSON Web Token
Paste a JWT to read its header and payload as pretty-printed JSON, with the registered claims explained and the time-based ones resolved against your clock. Then, if you hold the key, check the signature — which is the only step that tells you whether the token is real.
Decoding is not trusting
A JWT's first two segments are base64url, not ciphertext. Anyone who intercepts a token can read every claim in it, which is why a JWT should never carry a secret. Equally, anyone canwrite one — a token whose signature has not been checked carries no more authority than a form field. The classic failure is accepting alg: none, or verifying with the algorithm named in the attacker-supplied header rather than the one you expect.
What is checked here
- Structure — three segments, valid base64url, parseable JSON
- Registered claims —
iss,sub,aud,exp,nbf,iat,jti - Signature, against a key you supply, with the algorithm taken from the header and the
nonealgorithm rejected
Frequently asked questions
Does decoding a JWT mean it is genuine?
No, and this is the single most important thing to understand about JWTs. Anyone can read a token — the header and payload are just base64url-encoded JSON, not encryption. Only checking the signature against the right key proves the token was issued by who it claims and has not been altered. Use the verify panel below to actually check it.
What key do I paste to verify?
For HS256/HS384/HS512 it is the shared secret, as text. For RS*, PS*, ES* and EdDSA it is the issuer's public key in PEM form — the one from their JWKS endpoint or certificate, never the private key.
Why is my token reported as expired when it looks fine?
exp and nbf are checked against your computer's clock. If the machine is skewed, or the token was issued for a different timezone assumption, you will see a mismatch. The decoded panel shows both the raw timestamps and their human-readable equivalents so you can compare.
Is my token uploaded?
No. Decoding and verification both run locally in a WebAssembly module. That matters here more than on most tools — a JWT is often a live credential, and pasting one into a site that transmits it would be handing over an active session.