JWT Decoder
Decodes header and payload, shows claim expiry in local time, and checks the signature against a supplied key.
Decodes a JSON Web Token — header, payload and signature — explains what each standard claim means, and can verify the signature with a shared secret, a pasted key, or the issuer’s JWKS. Everything happens in the tab: the token itself is never sent anywhere.
The token stays in this tab.
Decoding and signature checking both run in your browser with WebCrypto. Nothing is uploaded and there is no server side to this page. The single request it can make is a GET to a JWKS URL you type — that request carries the URL and nothing else, never the token or a secret.
Token
A `Bearer ` prefix is stripped for you.
How to use it
Paste the token
A leading `Bearer ` is stripped for you. The header, payload and signature split immediately — no button to press.
Read the status line first
Expired, not yet valid, or within its window — computed against your clock. The time claims in the payload table are shown as an ISO timestamp, your local time and the raw epoch seconds together.
Verify the signature if it matters
A shared secret for HS256/384/512, or a JWKS URL or pasted key for the asymmetric algorithms. Decoding proves nothing about authenticity — only the signature check does.
Common questions
Is it safe to paste a production token here?
The token is decoded in your browser and never transmitted — there is no server side to this page. The one request it can make is a GET to a JWKS URL you type, which carries the URL and nothing else. Even so, a token in a browser tab is a token on screen, so treat it the way you would a password.
Anyone can read my payload?
Yes. A JWT is signed, not encrypted — the payload is Base64URL, which is an encoding. Never put anything in a JWT you would not put in a URL. That is exactly what this page demonstrates in one paste.
The signature verified — does that mean the token is good?
It means the token was signed by whoever holds that key and has not been altered since. It says nothing about expiry, audience, issuer or revocation. The status line covers expiry; the rest is your application’s job.
Why can it not check my ES256K or Ed448 token?
Because verification uses the browser’s WebCrypto, and those curves are not in it. HS, RS, PS and ES at 256/384/512 plus Ed25519 are what a browser can do; anything else is reported as not checkable rather than quietly passing.
Feed it from
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
JWKS Verifier
Fetches a JWKS endpoint, picks the key by kid and verifies a token’s signature and standard claims.
HMAC Generator
Computes an HMAC over a message with a chosen hash and key encoding, for webhook signature checks.
Unix Timestamp Converter
Converts between epoch seconds, milliseconds, ISO 8601 and human dates in any timezone.
Next
These accept what this tool produces, so the result can go straight in.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
Unix Timestamp Converter
Converts between epoch seconds, milliseconds, ISO 8601 and human dates in any timezone.
JWKS Verifier
Fetches a JWKS endpoint, picks the key by kid and verifies a token’s signature and standard claims.
Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
JSON ⇄ CSV
Flattens nested JSON into columns or rebuilds objects from a table, with a dot-path column naming rule.
JSON Diff
Compares two JSON documents structurally, ignoring key order and reporting added, removed and changed paths.