JWT Decoder for Spring Boot
Paste any JWT to decode it instantly — then use the Spring Security OAuth2 Resource Server examples below to configure JWT verification in your Spring Boot application.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to configure JWT verification in Spring Boot
Spring Boot applications typically use Spring Security's OAuth2 Resource Server support for JWT verification. Add spring-boot-starter-oauth2-resource-server to your dependencies. In application.properties, set spring.security.oauth2.resourceserver.jwt.jwk-set-uri to your provider's JWKS endpoint (or issuer-uri to use OIDC discovery). Spring Security will then automatically fetch public keys, verify incoming Bearer tokens, and populate the SecurityContext.
In your controllers, access the verified JWT claims via @AuthenticationPrincipal Jwt jwt. The Jwt object provides jwt.getSubject() for the sub claim, jwt.getClaimAsString('email') for custom claims, and jwt.getClaims() for all claims as a Map. Spring Security's method security (@PreAuthorize) can reference JWT claims via SpEL: @PreAuthorize('#jwt.subject == authentication.principal.subject').
Use the decoder above to quickly inspect tokens during development — paste a token from your application's Authorization header to verify the claims and expiry. The configuration snippet below covers the essential Spring Boot OAuth2 resource server setup.
Spring Boot — Spring Security OAuth2
java// pom.xml dependency:
// spring-boot-starter-oauth2-resource-server
// application.properties:
// spring.security.oauth2.resourceserver.jwt.jwk-set-uri=
// https://your-issuer/.well-known/jwks.json
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain security(HttpSecurity http)
throws Exception {
http
.authorizeHttpRequests(a -> a
.requestMatchers("/public/**").permitAll()
.anyRequest().authenticated())
.oauth2ResourceServer(o ->
o.jwt(Customizer.withDefaults()));
return http.build();
}
}
// In a @RestController:
@GetMapping("/me")
public Map<String, Object> me(
@AuthenticationPrincipal Jwt jwt) {
return Map.of(
"sub", jwt.getSubject(),
"email", jwt.getClaimAsString("email"),
"roles", jwt.getClaimAsStringList("roles")
);
}How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.