100% Client-side · Your token never leaves your browser
Decode JSON Web Tokens (JWT) Online
Inspect header, payload, and claim insights. Detects expired tokens and weak algorithms. Optional in-browser signature verification — never paste production secrets.
JSON Tools
Choose your method.
Beautify — pretty-print with 2-space indentation. Cmd+Enter to run
Input 0 chars
Output
Mode
Indent
Paste JSON and it updates live.
Or press Cmd+Enter.
FAQ
JWT Decoder — Frequently Asked Questions
Decoding JSON Web Tokens, supported algorithms, and how we keep your tokens private.
What is a JWT and what does this decoder show?
A JSON Web Token (JWT) is a base64url-encoded triplet of header, payload and signature. The JWT Decoder splits the three segments, decodes the header and payload, and shows you the JSON contents — issuer, subject, audience, expiry, and any custom claims.
Does the JWT Decoder verify the token signature?
Optionally, yes — fully in your browser. By default the tool just decodes the header and payload. Click Verify signature to validate the token: paste the shared secret for
HS256/HS384/HS512, or paste an SPKI PEM public key (BEGIN PUBLIC KEY) for RS/PS/ES algorithms. Verification runs entirely via the browser’s SubtleCrypto API — the key and the token never leave the page. For production secrets, prefer a backend or test environment.What claim insights does the JWT Decoder surface?
Issued time (iat), expiry status (valid / expires soon / expired) from exp, not-before (nbf), and warnings for weak algorithms (
alg: none, missing alg). Standard claims like iss/aud/sub are highlighted if present.Is my JWT token sent to a server when decoding?
Never. The decode happens entirely in your browser. We have no servers, no logs of your data, and no behavioural analytics on your token contents. Open DevTools → Network and verify it yourself before pasting any token.
What if the JWT is malformed or invalid?
You get a clear error: "Not a JWT (expected three base64url segments)" or a parse error pointing to which segment failed (header / payload / signature) — so you can fix the source instead of guessing.
Is it safe to paste production JWTs into this decoder?
The token never leaves your machine, so technically yes — but treat any access token as sensitive. Prefer test tokens whenever possible, and rotate any token that may have been logged elsewhere.
Can the decoder handle tokens signed with HS256, RS256 or ES256?
Yes. The header and payload are decoded regardless of algorithm — that is just base64url. The decoder also supports optional in-browser signature verification for
HS256/HS384/HS512 (with a shared secret), RS256/RS384/RS512, PS256/PS384/PS512 and ES256/ES384 (with an SPKI public key). The algorithm is always shown so you can spot weak choices like alg: none.More JSON tools