JWT Decoder & Verifier

Decode and inspect JWT tokens instantly. View header, payload, and signature. 100% client-side — your tokens never leave your browser.

Free Always No Account Needed 100% Client-Side
Header
{  "alg": "HS256",  "typ": "JWT"}
Payload
{  "sub": "1234567890",  "name": "John Doe",  "iat": 1516239022}
Signature (Base64URL)
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Advertisement

How to use JWT Decoder & Verifier Online

  1. 1
    Input Data or ParametersPaste your input string, code payload, or select parameters into the editor.
  2. 2
    Instant Local ComputationThe tool processes your request in real-time inside your browser using client-side JavaScript.
  3. 3
    Copy or Export OutputCopy the formatted result to your clipboard or download the output payload instantly.

About this tool

A JSON Web Token (JWT) consists of three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims/data), and the signature. This tool decodes all three parts instantly in your browser without sending your token anywhere.

Use this tool to debug authentication issues, inspect claims (iat, exp, sub, roles), check token expiration, and verify the algorithm being used. Simply paste any JWT and the decoder will display a formatted, color-coded breakdown of every field.

The signature verification tab lets you confirm the token hasn't been tampered with — paste your secret or public key and the tool will validate the signature client-side using the Web Crypto API.

Advertisement

Frequently Asked Questions

Is it safe to paste my JWT here?
Yes. This tool is 100% client-side. Your JWT never leaves your browser and is never sent to any server.
Can this tool verify JWT signatures?
Yes. Paste your HMAC secret or RSA/EC public key in the Verify tab to validate the signature.
What algorithms does it support?
It supports HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, and ES512.
Why does my JWT show 'expired'?
The 'exp' claim in the payload is a Unix timestamp. If that timestamp is in the past, the token is expired.

Related Tools

Base64 Encoder/Decoder

Encode and decode Base64 text and images. Supports URL-safe Base64. Preview images inline. 100% client-side.

Hash Generator

Generate cryptographic hashes (MD5, SHA-1, SHA-256, SHA-512) from any text. 100% client-side, instant results.

Password Generator

Generate strong, random passwords with custom length, character sets, and pronounceability. Check password strength.

Timestamp Converter

Convert Unix timestamps to human-readable dates and back. Supports ISO 8601, RFC 2822, UTC, and local timezone.