JWT decoder
Paste a JWT to instantly read its header and payload, check expiry time, and optionally verify the signature with a secret or public key — all without sending the token anywhere.
No uploads · Everything runs in this browser
Decoding only reads the contents. It does not prove the token is genuine.
Header
Payload
Times
| Expires (exp) | |
|---|---|
| Not before (nbf) | |
| Issued (iat) |
No exp, nbf or iat claims.
Verify signature (optional)
FAQ
Is it safe to paste a production token?
The token is decoded and verified only inside this browser and is never sent anywhere. Still, treat live tokens like passwords and avoid sharing your screen while they are visible.
Does decoding prove a token is valid?
No. Anyone can read a JWT. Only a signature check with the right secret or public key shows that the token has not been altered.
Which keys can I use for verification?
HS256/384/512 use a shared secret. RS, PS, ES and EdDSA use a public key in PEM (BEGIN PUBLIC KEY or BEGIN RSA PUBLIC KEY) or JWK/JWKS format.
What claims does the tool highlight?
exp (expiration), nbf (not before) and iat (issued at) are shown in human-readable local time, and the tool marks whether the token is currently valid, expired or not yet valid.
Can I verify RS256 or ES256 tokens?
Yes. Paste the PEM public key or a JWK/JWKS into the verification section. RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512 and EdDSA are all supported.