JWTDecoder.com

Decode, inspect and verify any JWT.

Paste a JSON Web Token to instantly inspect its header, claims, timestamps and signature — directly in your browser.

🔒 Your JWT never leaves your browser.
🔒 Decoded locally — never sent anywhere.0 chars
header.payload.signature

Paste a JWT above to decode it instantly, or try an example:

Developer utilities

Timestamp converter

Base64URL

Output
JWK / JWKS inspector
JWT size calculator
Decoding is not verification
A signed JWT is three Base64URL segments — header.payload.signature. Decoding the first two is trivial and proves nothing: anyone can create a token with any claims. JWTDecoder keeps three questions separate:
  1. Decoding — can the segments be parsed? If not, you get a precise diagnosis instead of “invalid token”.
  2. Signature verification — does the signature match the key you supply, using exactly the algorithm the token declares?
  3. Claim validation — are exp, nbf, iss and aud what your API expects?
On top of that you get a visual expiration timeline, human-readable claim analysis, security observations based on RFC 8725, JWKS matching by kid, and verification code in seven languages that pins the algorithm.
Need to create a token for testing? JWTEncoder.com builds and signs JWTs with human-friendly expiration controls, and the two tools hand tokens to each other through your clipboard — never through URLs.
Frequently asked questions
Is it safe to paste a production JWT here?
Decoding and verification run entirely in your browser with the Web Crypto API. The token, secrets and keys are never uploaded, stored, placed in the URL or sent to analytics. Even so, treat live tokens like passwords: prefer expired or test tokens and never share them.
Does decoding a JWT verify it?
No. Anyone can decode a signed JWT because the header and payload are only Base64URL-encoded. A token is trustworthy only after its signature is verified with the right key and its claims (exp, nbf, iss, aud) are validated. JWTDecoder reports these three results separately.
Which algorithms can be verified?
HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512, using a shared secret, a PEM public key or certificate, a JWK or a JWKS (matched by kid).
Why does my token say “Invalid signature”?
The most common causes are the wrong key or secret, a secret entered with the wrong encoding (UTF-8 vs Base64), a rotated key (check the kid against your JWKS), or a token that was modified after signing.
Can it decode encrypted tokens (JWE)?
A five-segment token is a JWE. Its payload is encrypted, so only the protected header (alg, enc, kid) can be shown without the recipient's private key.