viewjwt

JWT Decoder for Go

Paste any JWT to decode it instantly — then use the golang-jwt/jwt v5 code examples below to decode and verify JWTs in your Go application.

100% in-browser — nothing uploaded

Encoded JWT

HeaderPayloadSignature
Awaiting a token — everything is decoded locally in your browser.

Decoded Header

Paste a token to decode this segment.

Decoded Payload

Paste a token to decode this segment.

Verify Signature

Enter the secret to verify the signature

Features

100% private

Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.

Instant decoding

Paste a JWT and the header, payload, and claims are decoded in real time — no button required.

Human-readable claims

Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.

Signature verification

Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.

Go JWT guide

How to decode and verify JWTs in Go

The most popular JWT library for Go is golang-jwt/jwt (go get github.com/golang-jwt/jwt/v5). It is the maintained fork of the original dgrijalva/jwt-go library. The library provides jwt.Parse() and jwt.ParseWithClaims() for verifying and decoding tokens. You provide a key function that receives the parsed token header and returns the verification key — this is where you implement JWKS lookup or key selection by kid.

For structured claim types, define a struct embedding jwt.RegisteredClaims and pass it to jwt.ParseWithClaims(). This gives you strongly typed access to all standard claims. For JWKS support and fetching remote public keys, the lestrrat-go/jwx library is a comprehensive alternative that handles key set management, caching, and automatic refresh.

Use the decoder above to inspect any JWT instantly. The snippet below shows the core golang-jwt patterns for parsing signed tokens with both symmetric and asymmetric keys.

Go — golang-jwt/jwt v5

go
import (
    "github.com/golang-jwt/jwt/v5"
    "crypto/rsa"
)

// Custom claims struct
type Claims struct {
    Role string `json:"role"`
    jwt.RegisteredClaims
}

// Parse + verify (HS256)
token, err := jwt.ParseWithClaims(tokenStr, &Claims{},
    func(t *jwt.Token) (any, error) {
        if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, fmt.Errorf("unexpected alg: %v", t.Header["alg"])
        }
        return []byte(secret), nil
    })
claims := token.Claims.(*Claims)

// Parse + verify (RS256)
token, err := jwt.ParseWithClaims(tokenStr, &Claims{},
    func(t *jwt.Token) (any, error) {
        return publicKey, nil // *rsa.PublicKey
    })

// Decode without verification
p := jwt.NewParser()
unverified, _, _ := p.ParseUnverified(tokenStr, jwt.MapClaims{})
Step by step

How to decode a JWT token online

1

Paste your token

Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.

2

Read the decoded data

The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.

3

Verify the signature

Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.

FAQ

Frequently asked questions