JWT Decoder

Paste a JSON Web Token and it is split into Header, Payload and Signature as you type; whitespace and a leading Bearer are ignored. Header and payload appear as formatted JSON with numbers and strings exactly as in the token. The Claims table shows exp, nbf and iat as dates in your browser’s time zone with UTC on a second line, with relative time, and explains iss, sub, aud and jti.

A status line says Expired, Not valid yet or Within its validity period, plus “Signature not verified” until a check succeeds. Warnings flag alg none, a missing exp, an exp more than a year ahead and time claims that are not numbers. Errors name the part and the position.

Verify signature checks HS256/384/512 against a secret (text or base64), and RS, PS, ES and EdDSA (Ed25519) against a public key as PEM or JWK, using the browser’s Web Crypto API. Everything runs in your browser; nothing is uploaded or stored in the URL or browser storage, and Clear wipes it. Even so, do not paste production secrets or live tokens into any website.

Example

Token from RFC 7519 section 3.1:

eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

Header:

{
  "typ": "JWT",
  "alg": "HS256"
}

Payload:

{
  "iss": "joe",
  "exp": 1300819380,
  "http://example.com/is_root": true
}

The Claims table shows exp as 22 March 2011, 18:43:00 UTC (and in your local time above it), so the status reads Expired.

Verify a JWT in code

Always pin the accepted algorithm, and check the claims your service depends on.

import { jwtVerify } from "jose";

const secret = new TextEncoder().encode(process.env.JWT_SECRET);
const { payload } = await jwtVerify(token, secret, {
  algorithms: ["HS256"],
  issuer: "joe",
});

import jwt

payload = jwt.decode(
    token,
    secret,
    algorithms=["HS256"],
    options={"require": ["exp"]},
)

import "github.com/golang-jwt/jwt/v5"

token, err := jwt.Parse(tokenString, func(t *jwt.Token) (any, error) {
	return []byte(secret), nil
}, jwt.WithValidMethods([]string{"HS256"}))
if err != nil || !token.Valid {
	// reject
}

Limitations

• Encrypted tokens (JWE, five parts) are recognised and their header is shown, but they cannot be decrypted.
• The tool does not create or sign tokens.
• It does not fetch keys from a JWKS URL or an issuer. Paste the key yourself; from a JWK Set, copy one key.
• Private keys are rejected. PKCS#1 (BEGIN RSA PUBLIC KEY) and X.509 certificates are not accepted; convert them to SPKI (BEGIN PUBLIC KEY).
• ES256K and Ed448 are not supported. ES signatures must be raw r‖s, as JWS requires, not DER.
• EdDSA needs a browser whose Web Crypto supports Ed25519: Chrome 137, Firefox 129 or Safari 17 and later.
• Validity status uses your device clock. iss and aud are shown, not checked.

FAQ