JWT Decoder & Encoder
Decode a JWT online in seconds — inspect the header, payload, and claims, check expiration, and verify signatures, all privately client-side.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What is a JSON Web Token (JWT)?
A JSON Web Token is a compact, URL-safe standard (RFC 7519) for securely transmitting information between two parties as a JSON object. Because they are self-contained and signed, JWTs are the backbone of modern stateless authentication and authorization.
Every JWT is made of three parts separated by dots (.): a header, a payload, and a signature. The header and payload are simply Base64Url encoded — which is why a JWT decoder can read them instantly without any key.
Use the tool above to decode a JWT token, inspect its claims, check expiration, and verify its signature — all without anything leaving your machine.
Header
Specifies the token type (typ) and the signing algorithm (alg), such as HS256 or RS256. Base64Url encoded.
Payload
Contains the claims — statements about the subject such as sub, name, roles, and timestamps like iat and exp.
Signature
Created by signing the encoded header and payload with a secret or private key. Guarantees integrity.
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.
Frequently asked questions
JWT decoders for every stack
Provider-specific decoders, algorithm verifiers, and language guides — each with tailored explanations, claim references, and FAQs.
Identity Providers
Decode tokens from Auth0, Cognito, Firebase, Azure AD, and more.
Signing Algorithms
Decode and verify HS256, RS256, ES256, EdDSA, and every JWT algorithm.
Languages & Frameworks
Code examples for Node.js, Python, Java, Go, PHP, and more.
Tools & Tasks
Validate tokens, inspect claims, check expiry, and verify signatures.
Encoding & Format
Understand Base64Url encoding and extract JWT payloads as JSON.