Can this verify the signature?

Yes, if you provide the key. For HS256/384/512 tokens, paste the shared secret. For RS256/384/512 and ES256/384/512, paste the signer's public key in PEM format. The check runs with the browser's built-in Web Crypto API — the key is never sent anywhere.

Is my token uploaded anywhere?

No. Everything is decoded locally in your browser with plain JavaScript — the token never leaves your machine.

Why do exp and iat show as numbers and dates?

Those claims are Unix timestamps (seconds since 1970). We show both the raw number and the human-readable date so you don't have to convert it yourself.

What if the token doesn't decode?

A JWT needs exactly three dot-separated, base64url-encoded parts. If a part isn't valid JSON once decoded, you'll get an error explaining which part failed.

← Back to the toolbox

JWT DECODER

Paste a token, see the header, payload, and claims — decoded right here in your browser. Add a secret or public key and we'll check the signature too.

Token

Decoded entirely in your browser — the token never leaves this page. Add a secret or public key below to check the signature too.

How to decode a JWT

1
Paste your JWT into the input box.
2
The header, payload, and claims decode instantly, with exp and iat shown as readable dates.
3
To verify the signature, paste the shared secret (HS*) or the signer's public key (RS*/ES*).
4
Check the verification result shown below the decoded token.

Questions

Can this verify the signature?: Yes, if you provide the key. For HS256/384/512 tokens, paste the shared secret. For RS256/384/512 and ES256/384/512, paste the signer's public key in PEM format. The check runs with the browser's built-in Web Crypto API — the key is never sent anywhere.
Is my token uploaded anywhere?: No. Everything is decoded locally in your browser with plain JavaScript — the token never leaves your machine.
Why do exp and iat show as numbers and dates?: Those claims are Unix timestamps (seconds since 1970). We show both the raw number and the human-readable date so you don't have to convert it yourself.
What if the token doesn't decode?: A JWT needs exactly three dot-separated, base64url-encoded parts. If a part isn't valid JSON once decoded, you'll get an error explaining which part failed.