JWT Decoder
Paste a token to read the header and payload, then check the signature. The token and keys stay on this page.
Need to build a token? Open JWT Encoder
Encoded JWT
Header · Payload · Signature
Decoded Header
Decoded Payload
JWT signature verification
Optional. Enter the secret or public key used to sign the token. It never leaves this browser.
Algorithm none means the token is unsigned.
How to decode a JWT
1. Paste the token into Encoded JWT. The header and payload appear as JSON on the right.
2. Open Claims Breakdown to read iat, exp, and nbf as dates.
3. Enter the HMAC secret or public key to check the signature. Green means the signature matches.
What a JWT is
A JSON Web Token is three Base64url parts separated by dots: header, payload, and signature (RFC 7519). Anyone can read the payload. The signature proves it was signed with a known secret or key. Decoding is not the same as trusting the claims.
Algorithms on this page
HMAC (HS256, HS384, HS512) works in any browser tab. RSA (RS*), RSA-PSS (PS*), and ECDSA (ES*) need a secure context (HTTPS) for Web Crypto. EdDSA is not offered here.
Encode a JWT
To build and sign a token from header and payload JSON, use the JWT Encoder.
More free tools
Keep going
Open another tool. No account, and no install.