Decode and verify a JWT
Paste a JWT to see who issued it, who it’s for and when it expires, in plain words. Add the secret or public key to verify the signature.
Drop your file here
or click to browse
Nothing has left this page since you opened the tool. Show network activity
The browser enforces this: the site’s security policy only lets the page talk to the code libraries’ servers and an anonymous usage counter (tool name, file type, size range). A request carrying your file to anywhere else would be blocked before it left.
Check it yourself: open your browser’s developer tools, go to the Network tab, and run the tool. Or turn off Wi-Fi once the tool has loaded; it keeps working.
How it works
Paste a JWT to see who issued it, who it’s for and when it expires, in plain words. Add the secret or public key to verify the signature.
Paste a token (a leading “Bearer ” is fine) and it is split into its three coloured parts: header, payload and signature. The payload is shown as a list of claims with plain names (issuer, subject, audience, scopes, roles), and every date is turned into a real date with how long ago or how long is left, so you can see at a glance whether the token has expired or isn’t valid yet. Switch to JSON to see the raw header and payload and copy them. To check the token is genuine, paste the shared secret for HS256, HS384 or HS512, or the issuer’s public key for RS, PS, ES or EdDSA tokens, as a PEM public key, a JWK or a whole JWKS (the key is picked by its kid). The signature is verified with your browser’s built-in WebCrypto, and you’re told plainly whether it matches. Tokens with alg “none” are flagged, and encrypted tokens (JWE) are recognised. JWTs are often live login credentials: everything here runs on the page, and the token and key are never sent anywhere.
How to use it
- Paste the token. Header, payload and signature are decoded and coloured.
- Read the claims. Issuer, subject, audience and dates in plain words.
- Verify it. Add the secret or public key to check the signature.
Frequently asked questions
- Can it verify the JWT signature?
- Yes. Paste the secret for HS256/384/512, or the public key for RS, PS, ES and EdDSA tokens as a PEM, JWK or JWKS. It’s checked with your browser’s WebCrypto.
- Is it safe to paste a real token?
- Yes. Decoding and verifying happen on this page; the token and key are never sent to any server. Still, treat live tokens like passwords.
- How do I see when a JWT expires?
- The exp claim is shown as a date and as time left (or how long ago it expired), with a red or green badge at the top.
- Where do I find the public key?
- Most issuers publish a JWKS at /.well-known/jwks.json (or in their OpenID configuration). Paste the whole JSON; the right key is chosen by kid.
- Why does it say the signature doesn’t match?
- Either the key is wrong (a different secret, or the wrong key from a set), the secret is Base64-encoded (turn on the switch), or the token was changed after signing.