Header
Payload
Signature
Paste a JWT above to decode it instantly.
Free JWT Decoder & Debugger
Paste any JSON Web Token to instantly decode its header and payload, check expiration status, and verify its signature — HS256, RS256, ES256, PS256 and more. 100% client-side; your tokens never leave your browser.
9
Algorithms Supported
100%
Browser-Based Security
0
Data Sent to Servers
What's Inside a JWT
Header
A small JSON object naming the signing algorithm (alg) and
token type (typ). It's decoded, not encrypted — visible to anyone who has the
token.
Payload
The claims — the actual data, such as who the token represents
(sub) and when it expires (exp). Also just encoded, never treat it
as secret.
Signature
A cryptographic signature over the header and payload. This is the only part that proves the token is authentic and unmodified — and the only part that requires a key to check.
HMAC or public-key signedFrequently Asked Questions
What does a JWT decoder do?
A JWT decoder splits a token into its three parts — header, payload, and signature — then Base64URL-decodes the header and payload so you can read the actual claims and metadata inside, such as the algorithm used, the subject, and the expiration time.
Is decoding a JWT the same as verifying it?
No. Decoding just reveals the readable content of a token — it requires no secret and proves nothing about authenticity. Verifying checks the signature against a secret or public key to confirm the token is genuine and hasn't been tampered with. Anyone can decode a JWT; only someone with the correct key can verify one.
Do I need the secret key to decode a JWT?
No. The header and payload are only Base64URL-encoded, not encrypted, so anyone can decode and read them without any key. A secret or public key is only needed to verify the signature, not to decode the readable content.
Is my token data sent to your server?
No. This tool runs entirely in your browser using JavaScript and the Web Crypto API. Your token, secret key, and public key are never transmitted anywhere. You can verify this yourself by checking your browser's Network tab while using the tool.
Can I verify RS256 or ES256 tokens with this tool?
Yes. This decoder supports signature verification for HMAC algorithms (HS256, HS384, HS512) using a shared secret, and for public-key algorithms (RS256/384/512, ES256/384/512, PS256/384/512) using a PEM-formatted public key.
Why does my token show as expired?
JWTs commonly include an exp claim — a Unix timestamp marking
when the token stops being valid. If the current time is past that timestamp, the token
is expired and should be rejected by any server checking it, even if the signature itself
is still valid.
What does alg: none mean and why is it flagged?
An algorithm of "none" means the token claims to have no signature at all. This is a well-documented JWT vulnerability — some poorly configured libraries accept these tokens as valid without checking anything, letting an attacker forge arbitrary claims. Production systems should always reject unsigned tokens.
Need to Create a New Secret Key?
Generate a fresh, cryptographically secure JWT secret key for signing new tokens — free, instant, and 100% browser-based.
Go to JWT Secret Key Generator