JWT Decoder

A JSON Web Token (JWT, RFC 7519) is a compact, URL-safe string used to pass claims between systems, most often as an OAuth 2.0 access token or an OpenID Connect ID token. It has three base64url-encoded parts separated by dots: a header that names the signing algorithm, a payload with the claims, and a signature that proves the token was issued by someone holding the key.

The header and payload are encoded, not encrypted, so a JWT decoder can read them without any key. Verifying the signature is what tells you whether the token can be trusted. This JWT debugger does both, entirely in your browser.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9   ← header    {"alg":"HS256","typ":"JWT"}
.eyJzdWIiOiIxMjM0NTY3ODkwIn0          ← payload   {"sub":"1234567890"}
.SflKxwRJSMeKKF2QT4fwpMeJf36POk6y…   ← signature

• Instant decoding

  The header, payload, and signature are decoded as you paste. A Bearer prefix or surrounding quotes are removed automatically.

• Expiration at a glance

  exp, nbf, iat, and auth_time are shown as UTC and local dates with a live countdown, so you know immediately whether a token is expired.

• Signature verification

  Verify HMAC (HS256/384/512) with a secret, or RSA, RSA-PSS, ECDSA, and EdDSA with a PEM key, X.509 certificate, JWK, or JWKS.

• Claims explained

  Standard claims such as iss, sub, aud, and jti are labeled with plain-English descriptions.

• Clear error messages

  Malformed tokens, invalid base64url, non-JSON headers, and encrypted JWE tokens are reported precisely.

• Private by design

  Decoding and verification use your browser's Web Crypto API. Tokens, secrets, and keys never leave your device.

1. Paste the token into the Encoded Token box. A leading Bearer is removed automatically.
2. Read the decoded header, payload, and claims. The banner shows whether the token is expired.
3. To verify the signature, enter the shared secret (HS256/384/512) or paste the public key, certificate, or JWKS (RS, PS, ES, EdDSA).
4. A green Signature verified message confirms the token has not been modified.

iss (issuer), sub (subject), and aud (audience) identify who issued the token, who it is about, and who should accept it. exp (expiration time), nbf (not before), and iat (issued at) are NumericDate values: seconds since January 1, 1970 UTC. jti is a unique token ID that servers can use to reject replayed tokens.

A server must always verify the signature and check exp, nbf, iss, and aud before trusting a token. Never accept tokens with "alg": "none".