Free tool· Security & keys
Decode and verify JSON Web Tokens without sending them anywhere
Paste a token to see its header and claims, when it was issued and when it expires in IST, and whether its signature checks out against a shared secret, a PEM public key or a JWK. Sign HS256 test tokens too.
- Runs in your browser
- Free, no signup
- Updated
Verify the signature
Decoded
Paste a JWT to decode it
About this tool
What is the JWT Decoder & Verifier?
The JWT Decoder & Verifier is a free tool that decodes a JSON Web Token's header and claims, shows when it was issued and when it expires in IST, and verifies its signature against a shared secret, a PEM public key or a JWK. It supports HS, RS, PS, ES and EdDSA algorithms and signs HS256 test tokens.
- Price
- Free
- Signup
- None
- Your data
- Stays in your browser
- Updated
What you get
- Colour-coded header, payload and signature
- iat, nbf and exp in IST with live valid or expired status
- Signature verification: HS, RS, PS, ES and EdDSA
- PEM and JWK public keys supported
- Encode mode for HS256/384/512 test tokens
Security & keys · no account, nothing uploaded
How it works · three steps, no signup
How to use the JWT Decoder & Verifier
Step 1: Paste the token
Straight from an Authorization header — the “Bearer ” prefix is stripped. The three parts are colour-coded.
Step 2: Read the claims
Header and payload are pretty-printed; iat, nbf and exp are converted to IST with a live valid or expired status.
Step 3: Verify the signature
Add the secret or the issuer's public key (PEM or JWK) to confirm the token was signed by them and not altered.
FAQ
JWT Decoder & Verifier: questions and answers
Is a JWT encrypted?
Usually not. A signed JWT (JWS) is only base64url-encoded, so anyone holding it can read the header and payload — the signature stops tampering, not reading. Never put secrets or personal data you would not show the user in a JWT payload. Encrypted tokens (JWE) have five parts instead of three and need the decryption key.
Why does verification fail when the token decodes fine?
Decoding needs no key; verification does. Check that you used the right kind of key for the algorithm — a shared secret for HS256/384/512, the issuer's public key for RS, PS, ES and EdDSA — that the secret's encoding is right (text versus base64), and that the token was not edited or re-encoded on the way.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds: iat is when the token was issued, nbf is when it starts being valid and exp is when it stops. Servers usually allow a minute or two of clock skew. This tool shows each one in IST with a live countdown, so an expired token is obvious.
Can I sign tokens here?
Yes, with HMAC algorithms (HS256, HS384, HS512) — useful for testing an API locally. Tokens signed with private keys (RS, PS, ES, EdDSA) should be minted on your server, where the private key belongs, so this tool deliberately does not ask for one.
Is it safe to paste a production JWT here?
Nothing is sent to a server — decoding and verification use your browser's Web Crypto API. Still, a live token is a credential: anyone holding it can act as that user until it expires. Prefer expired or test tokens when debugging in any tool, never paste long-lived production tokens into chat or tickets, and rotate a token that may have leaked.
Still have questions?
Book a demoMore free tools
Keep your stack sharp
Ready to do this at scale?
InfiQ puts broadcasts, chatbots, a shared inbox and the developer API behind one dashboard — on the official WhatsApp Business API. 7-day free trial, no card required.