TextUtil LogoTextUtil

Categories

JWT Decoder

Decode, verify, and sign JWT tokens

JWT Decoder — Inspect JSON Web Tokens Online

This free JWT decoder parses a JSON Web Token and shows both its header and payload as formatted JSON, so you can see exactly which algorithm signed the token and what identity and authorization data it carries. It is invaluable for debugging login flows, checking expiry times, and verifying that your authentication server issues the claims you expect.

Everything happens entirely in your browser — the token is never sent to a server, which matters because access tokens are credentials. You can also verify the signature by supplying the shared secret (HMAC) or the issuer's public key (RSA/ECDSA); the check runs locally with the Web Crypto API.

How to use JWT Decoder

  1. Paste the full JWT (the xxxxx.yyyyy.zzzzz string) into the input box.
  2. The decoded header and payload appear instantly in separate panels as pretty-printed JSON, with the algorithm shown as a badge.
  3. Time claims (exp, iat, nbf) are rendered as human-readable dates, and a badge shows whether the token is expired, valid, or not yet valid.
  4. To check the signature, paste the shared secret (for HS256/384/512) or the issuer's PEM public key (for RS*/ES*) and press Verify — the check runs entirely in your browser via the Web Crypto API and shows a verified/invalid badge.

What is a JWT?

A JSON Web Token (RFC 7519) is a compact, URL-safe token format used to transmit claims between parties, most commonly as an OAuth 2.0 access token or an OpenID Connect ID token. A JWT has three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (the claims), and a signature that lets the recipient verify the token was issued by a trusted party and not modified.

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFkYSJ9.sig…

{
  "header":  { "alg": "HS256" },
  "payload": { "sub": "1234", "name": "Ada" }
}
The decoder Base64URL-decodes the header and payload segments into JSON.

Common JWT claims

  • iss (issuer) — who created the token, usually your identity provider's URL.
  • sub (subject) — the user or principal the token is about.
  • aud (audience) — the service the token is intended for.
  • exp (expiration) — a Unix timestamp after which the token must be rejected.
  • iat (issued at) and nbf (not before) — when the token was created and when it becomes valid.
  • Custom claims — roles, scopes, email, and any application-specific data the issuer adds.

Related terminology

Claim
A single key-value statement inside a JWT payload, such as the user's ID or the token's expiry time.
Base64URL
The URL-safe Base64 variant used for each JWT segment, using - and _ instead of + and /.
Signature
The third JWT segment, computed with HMAC or an asymmetric key, proving the token's integrity and origin.
Bearer token
A token presented in the Authorization header; whoever holds it is granted access, which is why JWTs must be kept secret.

Frequently asked questions

Is it safe to paste my JWT here?
The token is decoded locally in your browser and never transmitted. Even so, treat production access tokens as credentials: prefer decoding tokens from test environments when possible.
Does this tool verify the JWT signature?
Yes. Paste the shared secret (for HS256/384/512) or the issuer's PEM public key (for RS* and ES* algorithms) and the tool verifies the signature locally with the Web Crypto API, showing a verified or invalid badge. Nothing is sent to a server. It supports HMAC, RSA, and ECDSA; PS* (RSA-PSS) and EdDSA are not yet supported.
Why does my token fail to decode?
Make sure you copied the entire token — all three dot-separated segments — without surrounding whitespace or a leading "Bearer " prefix. Opaque (non-JWT) session tokens cannot be decoded.
How do I check when my JWT expires?
Decode the token and look at the exp claim, a Unix timestamp in seconds. You can convert it to a readable date with the Date Conversion utility on this site.
Can I create and sign a JWT here?
Yes. Switch to Encode / Sign mode, choose an HMAC algorithm (HS256, HS384, or HS512), enter your payload as JSON and a secret, and the token is signed in your browser with the Web Crypto API. Only HMAC signing is supported, and the secret never leaves your device.

Related tools