Digital ToolPad.

Runs 100% in your browser

Your data never leaves your device. zero uploads.

JWT Decoder

Decode a JWT header and payload locally to inspect the token's visible claims, and check its signature if you have the key.

Header (algorithm & type)
Loading...
Payload (data claims)
Loading...
Verify Signature

Working with JWT Decoder

Read the encoded JSON sections of a token when debugging authentication or inspecting a test fixture. Claims such as issuer, audience, and expiry can help explain a client issue. Treat their contents as untrusted until the signature has been verified with the correct secret or public key.

How to use JWT Decoder

  1. Paste the token into the Encoded box on the left.
  2. Read the decoded Header and Payload on the right, such as alg, iss, exp and iat.
  3. To check the signature, enter the HS secret or a PEM public key in the Verify Signature box, before or after pasting.

JWT Decoder example

Paste a test JWT and inspect its exp claim alongside its issuer. Compare the expiry timestamp with the behavior of your test application.

What to expect from the result

Decoding alone does not prove a token is authentic, so enter the secret or key to check the signature. Encrypted tokens (JWE, five dot-separated parts) cannot be decoded. A verified signature does not tell you whether your service accepts the token's issuer or audience.

JWT Decoder questions

How do I use JWT Decoder?

Paste the token into the Encoded box and the decoded Header and Payload appear on the right. No key is needed to decode, because the header and payload are only Base64URL-encoded. To verify the signature, enter the HS secret or a PEM public key in the Verify Signature box.

Does decoding a JWT prove it is valid?

No, decoding only shows the token's contents, and anyone can create a token with any payload. The badge shows "Signature Verified" only when the token checks out against the secret or key you enter. If the signature is correct but exp has passed, it shows "Signature Verified, Token Expired".

100% private: your data never leaves your browser

No registration, no tracking of your content, no server uploads. Don't just take our word for it:

  • No server, no uploads

    Your files and text are processed entirely on your device. Nothing is ever sent to us.

  • Works offline

    Once loaded, this tool keeps working with your Wi-Fi turned off. Try it.

  • Verify it yourself

    Open your browser's DevTools → Network tab. You'll see zero requests carrying your data.

Explore more tools

More utilities for your next task.

Browse all tools