JWT Decoder for Java
Paste any JWT to decode it instantly — then use the JJWT (io.jsonwebtoken) code examples below to decode and verify JWTs in your Java application.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to decode and verify JWTs in Java
The most widely used JWT library for Java is JJWT (io.jsonwebtoken), available on Maven Central. It provides a fluent builder API for creating JWTs and a parser API for verifying and extracting claims. Add jjwt-api, jjwt-impl, and jjwt-jackson to your pom.xml or build.gradle. Nimbus JOSE + JWT is another popular alternative, especially in Spring Security OAuth2 stacks.
JJWT's parser API enforces signature verification — you must provide a key to parse a signed JWT. For inspection without a key, use Jwts.parser().build().parseUnsecuredClaims() on an unsigned JWT, or extract claims manually via Base64 decoding. For RS256 tokens, load the PEM public key using Java's X509EncodedKeySpec and pass it to verifyWith().
For Spring Boot applications, Spring Security's built-in OAuth2 Resource Server support (spring-security-oauth2-resource-server) handles JWKS fetching and JWT verification automatically — see the spring-boot-jwt page for more. Paste a JWT above to decode it instantly without any Java setup.
Java — JJWT (io.jsonwebtoken)
javaimport io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import javax.crypto.SecretKey;
// Verify + decode (HS256)
SecretKey key = Keys.hmacShaKeyFor(secretBytes);
Claims claims = Jwts.parser()
.verifyWith(key)
.build()
.parseSignedClaims(token)
.getPayload();
String subject = claims.getSubject();
Date expiration = claims.getExpiration();
// Verify + decode (RS256 — public key)
PublicKey publicKey = /* load from PEM or KeyStore */;
Claims claims = Jwts.parser()
.verifyWith(publicKey)
.build()
.parseSignedClaims(token)
.getPayload();
// Inspect header without verification
Header header = Jwts.parser()
.build()
.parseUnsecuredHeader(token); // only for alg:none tokensHow to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.