JWT Decoder
dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PDO0hEc5cCPA
Verify signature
A JSON Web Token (JWT) is made of three Base64URL-encoded parts (a header, a payload, and a signature) separated by dots. This JWT decoder splits a pasted token and shows its decoded header and payload, including claims such as sub, iss and exp, plus an expiry countdown based on the 'exp' claim. It can also verify an HMAC (HS256/384/512) signature against a shared secret, which makes it a handy quick JWT debugger. Everything is decoded locally in your browser; your token is never sent anywhere.
Frequently asked questions
Is my token or secret sent to a server?
No. Decoding and signature verification both happen entirely client-side using the browser's built-in Web Crypto API — nothing leaves your browser.
Why can't I verify some tokens?
Signature verification here only supports HMAC-based algorithms (HS256, HS384, HS512), which use a shared secret. Tokens signed with RS256/ES256 and similar use asymmetric key pairs and require the issuer's public key, which this tool doesn't handle.
What does the expiry badge mean?
It reads the standard 'exp' claim (a Unix timestamp in seconds) from the payload and shows a live countdown to expiry, or how long ago the token expired if it already has.
How do I decode a JWT?
Paste the token into the input box. The header and payload are decoded and shown as formatted JSON straight away. No key is needed to read them, because they're only Base64URL-encoded, not encrypted.
What claims are in a JWT payload?
Common registered claims are iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at) and jti (token ID). Tokens can also carry custom claims, such as roles or user IDs.