JWT Decoder for Node.js
Paste any JWT to decode it instantly — then use the jsonwebtoken code examples below to implement decoding and verification in your Node.js application.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to decode and verify JWTs in Node.js
The most widely used JWT library in the Node.js ecosystem is jsonwebtoken (npm install jsonwebtoken). It supports all standard JWT signing algorithms including HS256/384/512, RS256/384/512, ES256/384/512, PS256, and EdDSA. The library provides jwt.sign() for creating tokens, jwt.verify() for verifying and decoding, and jwt.decode() for reading without verification.
For edge runtimes and environments without Node.js built-ins, the jose library (npm install jose) is an excellent alternative — it is Web Crypto API-based, works in Deno, Cloudflare Workers, Bun, and the browser, and supports JWKS fetching out of the box. For production applications, always use jwt.verify() rather than jwt.decode() to ensure the signature is validated before trusting any claims.
Use the decoder above to inspect a JWT without writing any code — paste your token to instantly see the header, payload, claims, and expiry. The code snippet below shows the key patterns for a Node.js backend.
Node.js — jsonwebtoken
javascriptconst jwt = require('jsonwebtoken')
// Decode without verification (never trust these claims)
const decoded = jwt.decode(token, { complete: true })
console.log(decoded.header) // { alg: 'RS256', typ: 'JWT', kid: '...' }
console.log(decoded.payload) // { sub: '123', exp: 1720000000, ... }
// Verify + decode (HS256 — shared secret)
const payload = jwt.verify(token, process.env.JWT_SECRET)
// Verify + decode (RS256 — public key)
const fs = require('fs')
const publicKey = fs.readFileSync('public.pem')
const payload = jwt.verify(token, publicKey, { algorithms: ['RS256'] })
// Create a token
const token = jwt.sign(
{ sub: 'user123', role: 'admin' },
process.env.JWT_SECRET,
{ algorithm: 'HS256', expiresIn: '1h' }
)How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.