JWT DECODER
Paste a token, see the header, payload, and claims — decoded right here in your browser. Add a secret or public key and we'll check the signature too.
In short
Paste a JSON Web Token and see the header, payload, and claims decoded instantly — dates included. Optionally verify the signature with your secret or public key. No account, no upload, decoded entirely in your browser.
Decoded entirely in your browser — the token never leaves this page. Add a secret or public key below to check the signature too.
How to decode a JWT
- 1
Paste your JWT into the input box.
- 2
The header, payload, and claims decode instantly, with exp and iat shown as readable dates.
- 3
To verify the signature, paste the shared secret (HS*) or the signer's public key (RS*/ES*).
- 4
Check the verification result shown below the decoded token.
Questions
- Can this verify the signature?
- Yes, if you provide the key. For HS256/384/512 tokens, paste the shared secret. For RS256/384/512 and ES256/384/512, paste the signer's public key in PEM format. The check runs with the browser's built-in Web Crypto API — the key is never sent anywhere.
- Is my token uploaded anywhere?
- No. Everything is decoded locally in your browser with plain JavaScript — the token never leaves your machine.
- Why do exp and iat show as numbers and dates?
- Those claims are Unix timestamps (seconds since 1970). We show both the raw number and the human-readable date so you don't have to convert it yourself.
- What if the token doesn't decode?
- A JWT needs exactly three dot-separated, base64url-encoded parts. If a part isn't valid JSON once decoded, you'll get an error explaining which part failed.
Related tools
- Base64 EncoderEncode text to Base64 or decode it back, with correct UTF-8 handling.
- URL Encoder / DecoderPercent-encode or decode text and URLs, component or full-URL scope.
- Hex ConverterConvert text to hexadecimal and back, both directions in one tool.
- Binary ConverterConvert text to binary and back, both directions in one tool.
- Base32 ConverterConvert text to Base32 and back using the RFC 4648 alphabet.
- Base58 ConverterConvert text to Base58 and back using the Bitcoin alphabet.
- HTML Encoder / DecoderEncode special characters to HTML entities (&, <, >, ") or decode them back to plain text. Updates as you type — nothing uploaded.
- Hash GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.
Updated