🔐 JWT Token Decoder & Verifier

Decode JWT tokens to view header and payload, and verify signatures — a free JWT token decoder and verifier.

🔑 JWT Token No Token

📋 Header

Header will appear here...

📄 Payload

Payload will appear here...

🔒 Signature Verification

Upload a public key to verify RS256 signatures:

💡 Sample JWT Tokens

Try these examples to test the decoder:

About JWT Decoder & Verifier

Our free online JWT decoder and verifier helps developers inspect and validate JSON Web Tokens. Whether you're debugging authentication issues, verifying API tokens, or learning about JWT structure, our tool provides comprehensive token analysis.

Features

JWT Decoder: Decode JWT tokens to view header and payload
Signature Verification: Verify RS256 signatures with public keys
Expiry Reporting: Check token expiration and validity
Token Information: Display key token metadata and claims
Public Key Support: Upload PEM format public keys
Security Analysis: Identify potential security issues

How to Use

Paste your JWT token into the input area
Click "Decode JWT" to view header and payload
Upload a public key to verify signatures
Review token information and expiry status
Check for security warnings and recommendations

Common Use Cases

✅ Debugging: Inspect JWT tokens for authentication issues
✅ API Development: Verify token structure and claims
✅ Security Testing: Validate token signatures and expiry
✅ Learning: Understand JWT structure and components
✅ Compliance: Check token security and best practices

Free Online JWT Decoder and Inspector

Paste any JSON Web Token to decode its header, payload, and signature — and inspect every claim. See the algorithm, expiry time, issuer, subject, and all custom claims in a readable format. Optionally verify the signature with a secret or public key. Everything runs in your browser; your token is never transmitted.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token for transmitting claims between parties. It has three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims — user data and metadata), and the signature (cryptographic proof of authenticity).

After login, a server issues a JWT that the client includes in subsequent API requests via the Authorization: Bearer <token> header. The server verifies the signature and reads the claims without needing a session database lookup.

Standard JWT Claims

sub — Subject: who the token is about (usually a user ID)

iss — Issuer: which service created the token

aud — Audience: which service the token is intended for

exp — Expiry Unix timestamp — after this, the token must be rejected

iat — Issued-at Unix timestamp

jti — JWT ID: unique identifier useful for revocation

Is the JWT payload encrypted?

No. The header and payload are only Base64URL-encoded — not encrypted. Anyone who holds a JWT can decode and read its contents. Never store passwords, credit card numbers, or other secrets in a JWT payload. The signature proves authenticity; it does not hide the data.

What is the difference between HS256 and RS256?

HS256 (HMAC-SHA256) uses a single shared secret — the same key signs and verifies. RS256 (RSA-SHA256) uses a key pair: a private key signs and a public key verifies. RS256 is preferred for distributed systems where verification services should not have the signing key.

My token shows as expired — what does that mean?

The exp claim is a Unix timestamp. If the current time is past that value, the token is expired and the server should return 401. The client must refresh the token using a refresh token or prompt re-login.