viewjwt

JWT Decoder for Python

Paste any JWT to decode it instantly — then use the PyJWT code examples below to implement decoding and verification in your Python application.

100% in-browser — nothing uploaded

Encoded JWT

HeaderPayloadSignature
Awaiting a token — everything is decoded locally in your browser.

Decoded Header

Paste a token to decode this segment.

Decoded Payload

Paste a token to decode this segment.

Verify Signature

Enter the secret to verify the signature

Features

100% private

Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.

Instant decoding

Paste a JWT and the header, payload, and claims are decoded in real time — no button required.

Human-readable claims

Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.

Signature verification

Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.

Python JWT guide

How to decode and verify JWTs in Python

The most popular JWT library for Python is PyJWT (pip install PyJWT). It supports HS256/384/512, RS256/384/512, ES256/384/512, PS256, and EdDSA. For asymmetric algorithms (RS256, ES256) you also need the cryptography package: pip install 'PyJWT[crypto]'. The library's jwt.decode() function both verifies and decodes in one step — use options={'verify_signature': False} only for inspection, never for production authorization.

Python-jose and authlib are alternatives worth knowing. python-jose provides a similar API to PyJWT with good JWKS support. authlib is a more comprehensive OAuth/OIDC library that includes JWT handling with excellent support for fetching and caching JWKS from remote providers. For FastAPI applications, fastapi-jwt-auth or python-jose are commonly used.

Use the decoder above to instantly inspect any JWT — no Python environment needed. The snippet below shows the key PyJWT patterns for decoding, verifying, and creating JWTs in a Python backend.

Python — PyJWT

python
import jwt

# Decode without verification (never trust these claims)
header = jwt.get_unverified_header(token)
payload = jwt.decode(token, options={"verify_signature": False})

# Verify + decode (HS256 — shared secret)
payload = jwt.decode(
    token,
    key="your-secret",
    algorithms=["HS256"]
)

# Verify + decode (RS256 — public key)
with open("public.pem", "rb") as f:
    public_key = f.read()
payload = jwt.decode(
    token,
    key=public_key,
    algorithms=["RS256"],
    audience="https://api.example.com"
)

# Create a token
import datetime
token = jwt.encode(
    {"sub": "user123", "exp": datetime.datetime.utcnow()
        + datetime.timedelta(hours=1)},
    "your-secret",
    algorithm="HS256"
)
Step by step

How to decode a JWT token online

1

Paste your token

Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.

2

Read the decoded data

The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.

3

Verify the signature

Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.

FAQ

Frequently asked questions