JWT Decoder & Verifier

Decode and inspect JWT tokens instantly. View header, payload, and signature. 100% client-side — your tokens never leave your browser.

Free Always No Account Needed 100% Client-Side
Header
{  "alg": "HS256",  "typ": "JWT"}
Payload
{  "sub": "1234567890",  "name": "John Doe",  "iat": 1516239022}
Signature (Base64URL)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

About this tool

A JSON Web Token (JWT) consists of three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims/data), and the signature. This tool decodes all three parts instantly in your browser without sending your token anywhere.

Use this tool to debug authentication issues, inspect claims (iat, exp, sub, roles), check token expiration, and verify the algorithm being used. Simply paste any JWT and the decoder will display a formatted, color-coded breakdown of every field.

The signature verification tab lets you confirm the token hasn't been tampered with — paste your secret or public key and the tool will validate the signature client-side using the Web Crypto API.

Frequently Asked Questions

Is it safe to paste my JWT here?
Yes. This tool is 100% client-side. Your JWT never leaves your browser and is never sent to any server.
Can this tool verify JWT signatures?
Yes. Paste your HMAC secret or RSA/EC public key in the Verify tab to validate the signature.
What algorithms does it support?
It supports HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, and ES512.
Why does my JWT show 'expired'?
The 'exp' claim in the payload is a Unix timestamp. If that timestamp is in the past, the token is expired.

Related Tools