JWT Decoder: Decode and Verify JSON Web Tokens Online
The JWT Decoder separates a JSON Web Token into its three base64url parts, decodes the header and payload as JSON, and displays the signature in hexadecimal. It also converts iat, nbf, and exp claims into readable dates with an expired/active badge. You can optionally verify HMAC signatures (HS256/384/512) with a shared secret; RS*/ES*/PS* tokens decode but require a key for verification.
JWT Decoder is a browser-based tool for decoding a JSON Web Token and inspecting its contents. It splits a JWT into its three base64url parts, decodes the header and payload as JSON, and displays the signature as hexadecimal. This gives you a readable view of the token's components without having to separate and decode them yourself.
The decoder also recognizes the iat, nbf, and exp time claims and renders them as human-readable dates, alongside an expired/active badge. If you want to check a signature, you can optionally use a shared secret with the HMAC algorithms HS256, HS384, or HS512. Tokens using RS*, ES*, or PS* algorithms can still be decoded, but they need a key for verification. Decoding shows token contents; it is distinct from verifying the signature.
A JWT is a compact token made up of encoded parts, while JSON is a structured data format used for readable objects and values. Decoding a JWT is useful when you need to inspect its JSON header and payload, understand its time claims, or investigate a token during development and troubleshooting. The signature is presented as hex rather than as JSON content.
JWT Decoder runs entirely in your browser: input is processed on your device and is not uploaded, stored, or sent to a server. Once the page has loaded, the tool works offline without a server connection. Developers and DevOps engineers can use it to examine tokens they receive, debug token-related issues, and review supported HMAC signatures without sending token data elsewhere.
Step 1: Paste or drop a JWT value into the tool. Use the token you want to inspect.
Step 2: Run the decode to separate the JWT into its three base64url parts. The header and payload are displayed as JSON, and the signature is shown as hex.
Step 3: Review the decoded header and payload, including readable dates for any iat, nbf, and exp claims. An expired/active badge helps you interpret the token's time status.
Step 4: To check an HMAC signature, provide the shared secret for a supported HS256, HS384, or HS512 token. RS*/ES*/PS* tokens can be decoded, but verification requires a key.
Use case: Inspect a JWT received through a channel that carries tokens. Decoding reveals its header and payload in a readable JSON format.
Use case: Recover and review the header and payload data in a JWT someone sent you. This helps you understand the token without manually separating its parts.
Use case: Check whether a token's iat, nbf, and exp values correspond to the dates you expect. The readable timestamps and expired/active badge make time claims easier to review.
Use case: Troubleshoot a token that an application is not accepting. Inspect its decoded claims and, for supported HMAC algorithms, optionally verify its signature with the shared secret.
Use case: Review the algorithm and other metadata in a JWT header before investigating how a token is used. The decoded JSON makes the header easier to read.
Use case: Confirm that the expected information appears in a JWT payload before using or sharing the token. The decoder exposes the payload as JSON for inspection.