Decoding only reads the token; it is not verified until the signature is checked with the right key.
This JWT decoder splits a JSON Web Token into its header, payload and signature and shows the claims as readable JSON, with exp, iat and nbf turned into local dates. It can also verify HS, RS, PS and ES signatures and sign new HS256 tokens. Decoding and verification run in your browser with the Web Crypto API.
How to use
- Paste a JWT. The header, payload and signature are colored and decoded as you paste.
- Read the claims: exp, iat and nbf are shown as your local time with “in 3 hours” or “expired 2 days ago”.
- To check the signature, enter the secret (HS256/384/512) or paste the public key as PEM, an X.509 certificate or a JWK (RS, PS and ES algorithms).
- Tap the header or payload to copy it as pretty JSON.
- Switch to Create to sign a new HS256/384/512 token from your own payload and secret.
- Nothing leaves your browser: decoding and verification use the built-in Web Crypto API, and tokens and keys are never stored or sent.
- Anyone can decode a JWT: the payload is only Base64URL-encoded, not encrypted. Never put secrets in it.
- A token with alg “none” has no signature at all. Servers must reject it.
- Supported algorithms: HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512. A JWKS ({"keys": […]}) works too; the key is chosen by kid.
- Turn on “Base64 secret” if your secret is stored Base64-encoded, as some providers do.
How a JWT is built
A JWT (RFC 7519) is three Base64URL strings joined by dots: header.payload.signature. The header names the algorithm, for example {"alg":"HS256","typ":"JWT"}. The payload holds claims such as sub (subject), iss (issuer), aud (audience), exp (expiry), iat (issued at) and nbf (not before). Times are NumericDate values: seconds since 1970-01-01 UTC, so exp 1767225600 means 2026-01-01 00:00 UTC.
The signature is computed over the first two parts. With HS256 it is an HMAC-SHA256 using a shared secret; with RS256 or PS256 an RSA signature; with ES256 an ECDSA signature on the P-256 curve (RFC 7518).
Decoding is not verifying
Anyone can read a JWT: Base64URL is an encoding, not encryption, so never put passwords or personal data in the payload. Trust a token only after the signature checks out with the right key and the exp and nbf times are valid. A token with alg none has no signature at all and must be rejected by servers. For HS algorithms the secret should be at least as long as the hash output, 32 random bytes for HS256.
Keys you can paste
For HS256, HS384 and HS512 enter the shared secret, as plain text or Base64. For RS, PS and ES algorithms paste the public key as PEM, an X.509 certificate, a single JWK or a whole JWKS; with a JWKS the key is picked by the kid in the header. Tokens and keys are never stored or sent.
Frequently asked questions
Is it safe to paste a JWT here?
Yes. The token is decoded and verified in your browser with the Web Crypto API and is not sent or saved. Still, treat production tokens like passwords and prefer expired or test tokens when you can.
Can a JWT be decoded without the secret?
Yes. The header and payload are only Base64URL-encoded, so anyone can read them. The secret or public key is needed only to check that the signature is genuine.
What does the exp claim mean?
exp is the expiry time in seconds since 1970-01-01 UTC. After that moment the token must be rejected. The decoder shows it as your local time with a note such as expired 2 days ago.
What is the difference between HS256 and RS256?
HS256 signs with one shared secret that both issuer and verifier must know. RS256 signs with an RSA private key and is verified with the public key, so verifiers never hold the signing key.
Why does signature verification fail?
The most common causes are a wrong or Base64-encoded secret, a public key that does not match the kid, or a token changed after signing. Turn on Base64 secret if your provider stores the secret encoded.
Can I create a JWT here?
Yes. The Create tab signs a token with HS256, HS384 or HS512 from your own header claims, payload and secret. RSA and EC signing are not offered because they need a private key.