JWT Decoder
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way of representing claims between two parties. JWTs are the de-facto standard for API authentication and authorization — think OAuth 2.0 access tokens, OpenID Connect ID tokens, and session tokens.
A JWT consists of three base64url-encoded parts separated by dots: the header (algorithm and token type), the payload (the claims, such as subject, issuer and expiry), and the signature (which proves the token wasn't tampered with).
Features
- Instant decoding — Paste a token and immediately see the header and payload as readable JSON, UTF-8 safe
- Human-readable timestamps —
iat,expandnbfclaims are rendered as real dates - Validity status — See at a glance whether a token is valid, expired, or not yet valid
- Algorithm display — The
algheader (HS256, RS256, …) is highlighted - HMAC signature verification — Optionally paste the shared secret and verify HS256, HS384 or HS512 signatures locally with WebCrypto
- Clear errors — Malformed tokens produce specific, actionable error messages
How to use
1. Paste your JWT into the input panel — decoding happens as you type
2. Inspect the header and payload claims, including human-readable dates
3. To verify an HMAC-signed token (HS256, HS384 or HS512), paste the shared secret into the signature section
Privacy
Everything runs entirely in your browser. Tokens and secrets are never sent to any server — decoding and verification happen 100% client-side.
Need to *create* a token instead? Use the [JWT Generator](/jwt-generator).