JWT Decoder

How it works

How to use the JWT Decoder

1. Paste a token

   With or without the "Bearer " prefix.

2. Read the claims

   Timestamps like exp, iat and nbf are shown as dates, with expiry status at a glance.

3. Verify the signature

   Enter the shared secret (HS*) or a PEM/JWK public key (RS*, PS*, ES*).

Is it safe to paste a JWT here?

Decoding and verification happen with your browser's built-in WebCrypto API. The token and keys are never sent to a server. Still, treat production tokens like passwords: they grant access until they expire. Remember that a JWT's payload is only encoded, not encrypted — anyone holding the token can read it.

Built for developers

Why developers use it

• Private by design

  Runs 100% in your browser. Nothing you paste is uploaded, logged or stored on a server.

• Instant results

  Output updates as you type, with precise error locations when something is wrong.

• Works offline

  Once loaded, the tool keeps working without a connection. Install it as an app if you like.

• Free, no sign-up

  No accounts, no limits, no watermarks.

FAQ

Frequently asked questions

Keep going

Related tools

• UUID GeneratorGenerate UUID v4 / v7 in bulk and inspect UUIDs
• Regex TesterTest JavaScript regular expressions with live highlighting
• Timestamp ConverterConvert Unix timestamps to dates and back, in any time zone
• Cron Expression ExplainerExplain crontab schedules and show next run times
• Text & File DiffCompare two texts or files line by line
• Credit Card ValidatorCheck card numbers with the Luhn algorithm
• JSON FormatterFormat, validate and explore JSON
• JSON to CSVConvert JSON arrays to CSV and CSV back to JSON

All Developer Tools → · Browse all 498 tools →