JWT Decoder for TypeScript
Paste any JWT to decode it instantly — then use the jose library code examples below to decode and verify JWTs in your TypeScript application with full type safety.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to decode and verify JWTs in TypeScript
The jose library (npm install jose) is the recommended JWT library for TypeScript. It is built on the Web Crypto API, ships full TypeScript types, and runs in Node.js 18+, Deno, Bun, Cloudflare Workers, and the browser without any changes. Its jwtVerify() function returns a strongly typed JWTPayload with IntelliSense for all standard claims. You can extend it with your own payload type via a generic parameter.
For fetching and caching remote JWKS (common with Auth0, Okta, and other providers), jose provides createRemoteJWKSet() which returns a compatible key input. It automatically caches the key set and re-fetches on rotation. Combined with jwtVerify(), this gives you a complete, production-ready token verification pipeline in just a few lines.
Use the decoder above to inspect any JWT instantly. The snippet below covers decoding, verification with a secret, verification with RS256 from a remote JWKS, and TypeScript-typed claims — all using the modern jose API.
TypeScript — jose
typescriptimport {
decodeJwt, decodeProtectedHeader,
jwtVerify, createRemoteJWKSet
} from 'jose'
// Decode without verification (typed)
interface MyClaims { role: string; org: string }
const payload = decodeJwt<MyClaims>(token)
const header = decodeProtectedHeader(token)
// Verify with HMAC secret (HS256)
const { payload } = await jwtVerify(
token,
new TextEncoder().encode(process.env.JWT_SECRET!),
{ issuer: 'https://auth.example.com', audience: 'my-api' }
)
// Verify RS256 with remote JWKS (Auth0 / Okta / etc.)
const JWKS = createRemoteJWKSet(
new URL('https://your-tenant.auth0.com/.well-known/jwks.json')
)
const { payload } = await jwtVerify<MyClaims>(token, JWKS, {
issuer: 'https://your-tenant.auth0.com/',
audience: 'https://api.example.com',
})How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.