JWT DecoderDeveloper Tools
Decodes JSON Web Tokens, explains the claims, and verifies HS, RS, PS, and ES signatures.
How to decode a JWT token and check that it can be trusted
A request fails with 401 and the only clue is a long string that starts with eyJ. Decode it to read the claims, then verify the signature before you believe any of them.
Decoding a JWT is not the same as trusting it
A signed JWT has three parts joined by dots: header.payload.signature. The header and payload are JSON written in Base64URL, which is Base64 with - and _ in place of + and /, and no padding. Anyone can decode them without a key, because a JWT is signed, not encrypted.
If you only decode a token, you may be reading a user ID and an expiry time that someone typed in themselves. A server that accepts alg none, or trusts a key the token supplies in its own header, lets anyone write their own claims. And since the payload is readable, a password or secret placed there is exposed to every client that holds the token.
Decode, verify, then inspect
Paste the token into the JWT Decoder. It shows the decoded header and payload and a claims table that turns exp, iat, and nbf from Unix seconds into dates and says whether the token has expired. To check the signature, paste the shared secret for HS algorithms, or a PEM public key for RS, PS, and ES, and press Verify. The check runs in your browser with the Web Crypto API, and the token is not sent to a server.
When the key comes from an identity provider, use the JWT Inspector. It takes a secret, a PEM key, a single JWK, or the whole JWKS, and picks the key whose kid matches the token. It applies the clock skew your service allows and puts iat, nbf, exp, and the current time on one timeline. It also warns about alg none, a short HMAC secret, a missing exp, a jku, x5u, or jwk in the header, and an exp that looks like milliseconds. It doesn't fetch the JWKS for you, so copy it from your provider's jwks_uri.
If a part refuses to decode, look at it in the Base64 Encoder and Decoder. It accepts both the standard and the URL-safe alphabet and missing padding, so you can decode the payload on its own and see whether it is valid JSON. Characters outside the alphabet, or an impossible length, give an error. That points to a token that was cut short or pasted with extra text around it.
Decode and verify a JWT
- Copy the token from the Authorization header or the response.
- Paste it into the JWT Decoder and read the header's alg and the payload's sub, iat, and exp.
- Paste the shared secret or the PEM public key and press Verify.
- If the key is published as a JWKS, paste the token and the JWKS into the JWT Inspector, set the clock skew, and press Verify.
- Read the warnings and fix the ones that apply before your service accepts the token.
What decoding and verifying won't do
- Encrypted tokens (JWE, five parts) can't be read without the private key.
- JWKS URLs and x5c certificates are not fetched. X.509 certificates and PKCS#1 RSA PUBLIC KEY blocks have to be converted to a PUBLIC KEY PEM with OpenSSL first.
- Audience and issuer are shown but not checked. Your server still has to check exp, aud, and iss.
- Base64 is an encoding. Decoding a part proves nothing about who made it.
Frequently asked questions
Can anyone decode a JWT?
Yes. The header and payload are only Base64URL encoded, not encrypted. Never put passwords or other secrets in a JWT payload.
Is it safe to paste a JWT into an online decoder?
These tools decode and verify in your browser and don't send the token anywhere. Still, treat live production tokens like passwords, prefer test tokens, and never paste a private key into any website.
Why does JWT verification fail with the right secret?
The secret may be stored as Base64, and some systems sign with its decoded bytes. Tick Secret is Base64 encoded and try again.
Why does my JWT show as expired?
The exp claim is earlier than your device's clock. Get a new token from the issuer, or set the clock skew your service allows in the JWT Inspector.
Related tools
Tools used in this guide
JWT InspectorDeveloper Tools
Signature check with JWKS key selection, a claim timeline with clock skew, and security warnings.
Base64 Encoder / DecoderDeveloper Tools
Encodes and decodes Base64 for text and files.
