JWT
Decode, encode, and verify JSON Web Tokens online — HMAC, RSA, and ECDSA. Free, and entirely in your browser.
What is a JWT (JSON Web Token)?
A JSON Web Token is a compact, URL-safe token format made of three Base64URL-encoded parts separated by dots: header.payload.signature. The header names the signing algorithm, the payload carries claims like sub, iat, exp, and aud, and the signature lets a server verify the token wasn't modified after it was issued.
JWTs are the backbone of most modern session and API authentication — this decoder breaks a token apart, shows every claim in a searchable table, and can verify the signature against your own secret or key.
How to decode and verify a JWT
- Paste a token into the Decode tab — the header, payload, and signature are colorized separately.
- Browse claims in the Claims table or switch to Raw JSON to see the header and payload exactly as issued.
- To check the signature, pick the algorithm the token was signed with, paste the matching secret or public key, and click Verify signature.
- Use the Encode tab to build and sign a brand-new token from scratch.
Frequently asked questions
Is it safe to paste a production JWT into this decoder?
Decoding and verification both run entirely in your browser — the token, secret, and any keys you enter are never sent to a server. Still, treat tokens like credentials: avoid pasting production tokens on a shared or public computer.
Which signing algorithms does the verifier support?
HMAC (HS256, HS384, HS512) with a shared secret, RSA (RS256, RS384, RS512) with a public/private key pair, and ECDSA (ES256, ES384, ES512) with an EC key pair.
Can anyone read the contents of a JWT without the secret?
Yes. The header and payload are only Base64URL-encoded, not encrypted — anyone can decode them. The signature doesn't hide the data, it only proves the token wasn't tampered with (assuming the signing key stays private).
Why does my token say it's expired?
The 'exp' claim is a Unix timestamp for when the token stops being valid. This tool checks it against your current clock and flags the token as expired the moment that time has passed, even if the signature is still valid.
Can I create a new JWT, not just decode one?
Yes — switch to the Encode tab to build a header and payload, pick an algorithm, provide a secret or private key, and get a signed token back.