JWT Decoder for Laravel
Paste any JWT to decode it instantly — then use the tymon/jwt-auth code examples below to implement stateless JWT authentication in your Laravel application.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to implement JWT authentication in Laravel
The most popular JWT package for Laravel is tymon/jwt-auth (composer require tymon/jwt-auth). It integrates with Laravel's authentication system via a custom guard driver, allowing you to protect routes with auth:api middleware and access the authenticated user via auth()->user(). It generates a JWT secret key (php artisan jwt:secret) used to sign tokens with HS256 by default.
tymon/jwt-auth provides a JWTAuth facade and a JWTGuard that replace the standard session-based authentication. Use auth()->attempt($credentials) to authenticate and receive a JWT, auth()->user() to get the current user from the token, and auth()->refresh() to issue a new token before the current one expires. The package handles token parsing and validation automatically from the Authorization header.
Use the decoder above to inspect Laravel JWT tokens during development. The snippet below covers the essential configuration and controller patterns for a Laravel API using jwt-auth.
Laravel — tymon/jwt-auth
php<?php
// config/auth.php guards section:
// 'api' => ['driver' => 'jwt', 'provider' => 'users']
// AuthController.php
use Tymon\JWTAuth\Facades\JWTAuth;
public function login(Request $request): JsonResponse
{
$credentials = $request->only('email', 'password');
if (!$token = auth('api')->attempt($credentials)) {
return response()->json(['error' => 'Unauthorized'], 401);
}
return response()->json([
'access_token' => $token,
'token_type' => 'bearer',
'expires_in' => auth('api')->factory()->getTTL() * 60,
]);
}
public function me(): JsonResponse
{
return response()->json(auth('api')->user());
}
public function refresh(): JsonResponse
{
return response()->json([
'access_token' => auth('api')->refresh(),
]);
}How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.