JWT Decoder for PHP
Paste any JWT to decode it instantly — then use the firebase/php-jwt code examples below to decode and verify JWTs in your PHP application.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to decode and verify JWTs in PHP
The most popular JWT library for PHP is firebase/php-jwt (composer require firebase/php-jwt). It supports HS256/384/512, RS256/384/512, ES256/384/512, and EdDSA. The JWT::decode() static method verifies the signature and returns the payload as a PHP object. Provide an associative array of keys using the Key class — this supports multiple keys for key rotation scenarios.
For asymmetric algorithms (RS256, ES256), load the public key with openssl_get_publickey() or pass the PEM string directly wrapped in a Key object. PHP's openssl extension must be enabled. For projects that need JWKS support (fetching public keys from a URL), consider Firebase PHP JWT's JWK::parseKeySet() helper or the web-token/jwt-framework library for more advanced use cases.
Use the decoder above to instantly view any JWT's claims — no PHP environment needed. The snippet below covers the core patterns for decoding, verifying, and issuing JWTs in PHP.
PHP — firebase/php-jwt
php<?php
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Firebase\JWT\JWK;
// Decode + verify (HS256 — shared secret)
$decoded = JWT::decode($token, new Key('your-secret', 'HS256'));
echo $decoded->sub; // user123
// Decode + verify (RS256 — public key from PEM)
$publicKey = file_get_contents('public.pem');
$decoded = JWT::decode($token, new Key($publicKey, 'RS256'));
// Decode + verify (RS256 — from JWKS JSON)
$jwksJson = file_get_contents('https://issuer/.well-known/jwks.json');
$keys = JWK::parseKeySet(json_decode($jwksJson, true));
$decoded = JWT::decode($token, $keys);
// Create a token
$payload = ['sub' => 'user123', 'exp' => time() + 3600];
$token = JWT::encode($payload, 'your-secret', 'HS256');How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.