JWT Decoder for PHP

Paste any JWT to decode it instantly — then use the firebase/php-jwt code examples below to decode and verify JWTs in your PHP application.

100% in-browser — nothing uploaded

Encoded JWT

HeaderPayloadSignature
Awaiting a token — everything is decoded locally in your browser.

Decoded Header

Paste a token to decode this segment.

Decoded Payload

Paste a token to decode this segment.

Verify Signature

Enter the secret to verify the signature

Features

100% private

Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.

Instant decoding

Paste a JWT and the header, payload, and claims are decoded in real time — no button required.

Human-readable claims

Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.

Signature verification

Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.

PHP JWT guide

How to decode and verify JWTs in PHP

The most popular JWT library for PHP is firebase/php-jwt (composer require firebase/php-jwt). It supports HS256/384/512, RS256/384/512, ES256/384/512, and EdDSA. The JWT::decode() static method verifies the signature and returns the payload as a PHP object. Provide an associative array of keys using the Key class — this supports multiple keys for key rotation scenarios.

For asymmetric algorithms (RS256, ES256), load the public key with openssl_get_publickey() or pass the PEM string directly wrapped in a Key object. PHP's openssl extension must be enabled. For projects that need JWKS support (fetching public keys from a URL), consider Firebase PHP JWT's JWK::parseKeySet() helper or the web-token/jwt-framework library for more advanced use cases.

Use the decoder above to instantly view any JWT's claims — no PHP environment needed. The snippet below covers the core patterns for decoding, verifying, and issuing JWTs in PHP.

PHP — firebase/php-jwt

php
<?php
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Firebase\JWT\JWK;

// Decode + verify (HS256 — shared secret)
$decoded = JWT::decode($token, new Key('your-secret', 'HS256'));
echo $decoded->sub; // user123

// Decode + verify (RS256 — public key from PEM)
$publicKey = file_get_contents('public.pem');
$decoded = JWT::decode($token, new Key($publicKey, 'RS256'));

// Decode + verify (RS256 — from JWKS JSON)
$jwksJson = file_get_contents('https://issuer/.well-known/jwks.json');
$keys = JWK::parseKeySet(json_decode($jwksJson, true));
$decoded = JWT::decode($token, $keys);

// Create a token
$payload = ['sub' => 'user123', 'exp' => time() + 3600];
$token = JWT::encode($payload, 'your-secret', 'HS256');
Step by step

How to decode a JWT token online

1

Paste your token

Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.

2

Read the decoded data

The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.

3

Verify the signature

Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.

FAQ

Frequently asked questions