JWT Decode / Validate
Decode JWT tokens to inspect header, payload, and signature.
About the JWT Decode / Validate
Decode a JSON Web Token to inspect its header and payload in readable JSON. A JWT is three Base64URL segments separated by dots, and decoding it shows exactly which claims a token carries, which algorithm signed it, and whether it has already expired.
How to use it
- 1 Paste the full JWT — all three dot-separated segments.
- 2 The header and payload are decoded and pretty-printed immediately.
- 3 To check the signature, paste the shared secret (for HS algorithms) or the public key as PEM or JWK (for RS, PS and ES).
- 4 Read the verdict: a valid signature, a mismatch, or an expired-but-correctly-signed token — the tool distinguishes all three.
- 5 Review the claims table to see what each claim means and when the token expires.
What it does
- Verify the signature for HS256/384/512 with a shared secret
- Verify RS, PS and ES algorithms with a PEM or JWK public key
- Header and payload decoded to formatted JSON
- Every claim explained in plain English, with timestamps as readable dates
- Expiry countdown and not-yet-valid detection
- Warns on alg: none and resists algorithm-confusion attacks
- Runs locally — neither the token nor the key is ever uploaded
Frequently asked questions
Is it safe to paste a real token here?
Decoding runs entirely in your browser and nothing is transmitted, so no request carries your token off the device. That said, treat any unexpired access token as a live credential: prefer a token from a development environment, and rotate anything you have pasted into a tool you do not control.
How do I verify a JWT signature here?
Paste the token, then paste the key: the shared secret for HS256/384/512, or the public key as a PEM "PUBLIC KEY" block or JWK for RS, PS and ES algorithms. Verification uses the browser's Web Crypto API, so the key never leaves your machine. The verifier pins the algorithm declared in the header, which is what prevents an attacker re-signing an RS256 token as HS256 using the public key as the secret.
Does decoding a JWT verify it?
No. Decoding just Base64-decodes the segments — anyone can read a JWT payload without any key at all. Verification means recomputing the signature with the secret or public key, which is what your server must do on every request. A decoded token proves nothing about authenticity.
Is JWT payload data encrypted?
No. The payload is Base64URL-encoded, not encrypted, and is fully readable by anyone holding the token. Never put passwords, personal data, or secrets in a JWT payload. If you need confidentiality, use JWE rather than the ordinary signed JWS format.
What does alg: none mean?
It means the token claims to need no signature. It is a notorious vulnerability class: libraries that honour it will accept a forged token with any payload. Production verifiers must pin the expected algorithm and reject "none" outright.
How do I read the exp claim?
exp is a Unix timestamp in seconds — not milliseconds — giving the moment the token stops being valid. This tool renders it as a human-readable date and flags tokens that are already past it.