JWT Decoder
Decode JWTs and verify signatures locally.
Token
Your token is decoded and verified entirely in your browser. It is never sent anywhere.
Decoded
Algorithm: —
Header
Payload
Verify signature (optional)
About JWT
A JSON Web Token has three base64url-encoded parts: header (algorithm and
type), payload (claims such as sub, iat,
exp) and exp signature. Decoding is trivial — anyone can read the
header and payload. The signature is what proves the token wasn\u2019t tampered with, and this
tool verifies it locally whenever you supply the matching secret or public key.
Frequently asked questions
Is my JWT sent anywhere?
No. Decoding and signature verification run entirely in your browser. Your token never touches a server.
Can you verify the signature?
Yes, locally. Provide the HMAC secret for HS256/384/512 tokens, or a PEM public key for RS256/384/512 (and PS/ES variants where the browser supports them).
What do exp and iat mean?
exp (expiration time) and iat (issued at) are NumericDate claims — seconds since the Unix epoch. The decoder converts them to readable dates and warns when a token is expired or not yet valid.