JWT Decoder
Decode and inspect JSON Web Tokens. Verify signatures with HS256, RS256, or ES256.
Shareable URL: your token is encoded in the page URL. Anyone with the link can read the token.
Frequently asked questions
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three Base64url-encoded parts separated by dots: a header (algorithm and type), a payload (the claims), and a signature.
No. Everything happens in your browser using JavaScript. The token never leaves your device. That said, treat a real, live JWT like a password — anyone who can read it can impersonate the token holder until it expires.
Yes, for HS256/HS384/HS512 (with the HMAC secret) and RS256/RS384/RS512 and ES256/ES384/ES512 (with the public key in PEM format). All verification uses the browser's built-in Web Crypto API.
exp is the expiration time, as a Unix timestamp (seconds since January 1, 1970 UTC). The decoder shows how long until expiry, or how long ago it expired, in plain language.
RS256 uses asymmetric cryptography. The token is signed with a private key. You can only verify it with the corresponding public key — which you must obtain separately (e.g., from the issuer's JWKS endpoint).
A JWT with alg: none has no signature. Any payload can be placed in it. Never accept a none-algorithm JWT in production — it is a well-known security vulnerability.