JWT Decoder & Verifier
Decode a JWT's header and payload instantly and check expiry — plus HS256/RS256/ES256 signature verification, all in your browser.
🔒 The token and key are processed only in your browser and never sent to a server. Do not paste real production secrets on a shared computer.
Header and payload at a glance
Paste a JWT and its header and payload decode into nicely formatted JSON — see the algorithm, token type and claims like sub, iss and scope. It is the quickest way to inspect a token while debugging an API.
Automatic time conversion
Time claims like exp, iat and nbf are converted to human-readable dates, with a valid/expired badge, so you can immediately see whether a token has expired when a 401 shows up.
Verify the signature
Optionally verify the signature: provide the secret for HS256, or a PEM public key for RS/ES algorithms, and the browser's Web Crypto checks it — useful for catching tampered or wrongly-signed tokens.
Frequently asked questions
What does pasting a JWT show?
It decodes the header and payload into formatted JSON and converts time claims to dates, including whether the token is expired.
How do I verify the signature?
Enter the secret for HS256, or a PEM public key for RS/ES, then click verify; Web Crypto checks validity locally.
Are the token or key uploaded?
No. Everything runs in your browser. Still, avoid pasting real production secrets on a shared computer.
Can I tell if a token is expired?
Yes. It compares the exp claim against the current time and marks it valid or expired.