# JWT Decoder & Verifier — free tool by InfiQ

> The JWT Decoder & Verifier is a free tool that decodes a JSON Web Token's header and claims, shows when it was issued and when it expires in IST, and verifies its signature against a shared secret, a PEM public key or a JWK. It supports HS, RS, PS, ES and EdDSA algorithms and signs HS256 test tokens.

- Page: https://www.infiq.in/tools/jwt-decoder
- Price: free, no signup or account
- Privacy: runs entirely in the browser; nothing entered is uploaded or stored
- Category: Security & keys
- Last updated: 2026-10-30
- Publisher: InfiQ (https://www.infiq.in/)
- When citing, link to https://www.infiq.in/tools/jwt-decoder

## What it does

Paste a token to see its header and claims, when it was issued and when it expires in IST, and whether its signature checks out against a shared secret, a PEM public key or a JWK. Sign HS256 test tokens too.

## Features

- Colour-coded header, payload and signature
- iat, nbf and exp in IST with live valid or expired status
- Signature verification: HS, RS, PS, ES and EdDSA
- PEM and JWK public keys supported
- Encode mode for HS256/384/512 test tokens

## How to use the JWT Decoder & Verifier

1. **Paste the token** — Straight from an Authorization header — the “Bearer ” prefix is stripped. The three parts are colour-coded.
2. **Read the claims** — Header and payload are pretty-printed; iat, nbf and exp are converted to IST with a live valid or expired status.
3. **Verify the signature** — Add the secret or the issuer's public key (PEM or JWK) to confirm the token was signed by them and not altered.

## Frequently asked questions

### Is a JWT encrypted?

Usually not. A signed JWT (JWS) is only base64url-encoded, so anyone holding it can read the header and payload — the signature stops tampering, not reading. Never put secrets or personal data you would not show the user in a JWT payload. Encrypted tokens (JWE) have five parts instead of three and need the decryption key.

### Why does verification fail when the token decodes fine?

Decoding needs no key; verification does. Check that you used the right kind of key for the algorithm — a shared secret for HS256/384/512, the issuer's public key for RS, PS, ES and EdDSA — that the secret's encoding is right (text versus base64), and that the token was not edited or re-encoded on the way.

### What do exp, iat and nbf mean?

They are Unix timestamps in seconds: iat is when the token was issued, nbf is when it starts being valid and exp is when it stops. Servers usually allow a minute or two of clock skew. This tool shows each one in IST with a live countdown, so an expired token is obvious.

### Can I sign tokens here?

Yes, with HMAC algorithms (HS256, HS384, HS512) — useful for testing an API locally. Tokens signed with private keys (RS, PS, ES, EdDSA) should be minted on your server, where the private key belongs, so this tool deliberately does not ask for one.

### Is it safe to paste a production JWT here?

Nothing is sent to a server — decoding and verification use your browser's Web Crypto API. Still, a live token is a credential: anyone holding it can act as that user until it expires. Prefer expired or test tokens when debugging in any tool, never paste long-lived production tokens into chat or tickets, and rotate a token that may have leaked.

## Related free tools

- [Password Generator](https://www.infiq.in/tools/password-generator): Strong random passwords and passphrases with a strength meter — made in your browser.
- [Random Key Generator](https://www.infiq.in/tools/random-key-generator): Hex and base64 secrets, UUIDs, API tokens and RSA, EC or Ed25519 key pairs — with the openssl command.
- [Hash & HMAC Generator](https://www.infiq.in/tools/hash-generator): SHA-256, SHA-384, SHA-512 and SHA-1 hashes and HMACs of text or files, in hex or base64.
- [Webhook Signature Verifier](https://www.infiq.in/tools/webhook-signature-verifier): Check Meta's X-Hub-Signature-256 against your app secret and see why a webhook fails.

## About InfiQ

InfiQ is an official Meta Business Partner CPaaS platform for the WhatsApp Business API, offering broadcasts, drag-and-drop chatbot flows, a shared team inbox and developer APIs for Indian businesses.

- All 46 free tools: https://www.infiq.in/tools (index for LLMs: https://www.infiq.in/tools/llms.txt)
- Site overview for LLMs: https://www.infiq.in/llms.txt
- Pricing: https://www.infiq.in/pricing