JWT Decoder for Ruby
Paste any JWT to decode it instantly — then use the ruby-jwt gem code examples below to decode and verify JWTs in your Ruby or Ruby on Rails application.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to decode and verify JWTs in Ruby
The standard JWT library for Ruby is the jwt gem (gem install jwt). It supports all common JWT algorithms: HS256/384/512, RS256/384/512, ES256/384/512, PS256, and EdDSA. The JWT.decode() class method verifies the signature and returns the payload hash and header hash as a two-element array. Pass false as the verify parameter for inspection-only decoding without signature verification.
For RS256, load the PEM-encoded public key with OpenSSL::PKey::RSA.new(File.read('public.pem')). For ES256 use OpenSSL::PKey::EC.new. If you need JWKS support (fetching keys from a URL), the jwt gem does not include a JWKS client natively — combine it with the jwks-rsa Ruby gem or implement the fetching manually with Net::HTTP and parse the key set.
Use the decoder above to instantly view any JWT's claims without installing Ruby. The snippet below covers the essential JWT patterns for Ruby and Rails backends.
Ruby — ruby-jwt
rubyrequire 'jwt'
require 'openssl'
# Decode without verification (inspection only)
payload, header = JWT.decode(token, nil, false)
puts header['alg'] # RS256
puts payload['sub'] # user123
# Verify + decode (HS256 — shared secret)
payload, _header = JWT.decode(
token,
'your-secret',
true,
algorithms: ['HS256']
)
# Verify + decode (RS256 — public key from PEM)
public_key = OpenSSL::PKey::RSA.new(File.read('public.pem'))
payload, _header = JWT.decode(
token,
public_key,
true,
algorithms: ['RS256']
)
# Create a token (HS256)
token = JWT.encode(
{ sub: 'user123', exp: Time.now.to_i + 3600 },
'your-secret',
'HS256'
)How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.