JWT Decoder
See what's inside a token, when it expires, and whether its signature is genuine.
- Your data never leaves your device
- 100% free
- No sign-up
- Works offline after first load
How to decode a JWT
- Paste a JWT.
- Read the header, payload and explained claims; check the expiry.
- Enter the secret or public key to verify the signature — or create your own token.
About JWT Decoder
Decode JSON Web Tokens and verify their signatures.
Everything works in your browser, so it is instant and private, and your settings are remembered on this device.
Good for
- Debugging login and API authentication
- Checking token expiry and scopes
- Testing JWT signing in development
Tip: If the signature fails, check for a kid mismatch, a secret stored as Base64, or a key for a different algorithm.
Frequently asked questions
Is it safe to paste my token here?
Yes — decoding and verification happen entirely in your browser with the Web Crypto API. The token, secret and keys are never sent anywhere. Still, treat production tokens like passwords.
How do I verify the signature?
For HS256/384/512 enter the shared secret (tick “Base64 encoded” if it is). For RS, PS, ES and EdDSA paste the public key as PEM, an X.509 certificate, a JWK or a JWKS — the key matching the token’s kid is used.
Can I read an encrypted token?
No — a JWE (five parts) is encrypted and needs the private key. Normal JWTs (three parts) are only signed, so anyone can read the payload — never put secrets in them.
Can I create a token?
Yes — open “Create a token”, edit the header and payload (with shortcuts for iat, exp and nbf), enter a secret or private key and the signed token is built instantly. You can also generate a test key pair.
Why does my token show as expired?
Its exp claim is a time in the past. The decoder compares it with your device's clock and shows the expiry date in your time zone.