Developer utility

JWT Decoder & Signature Verifier

Decode and verify JSON Web Tokens, claims and signatures.

Free toolkit with a JSON formatter, encoder/decoder, encryption utility and JWT parser.

Everything is processed locally in your browser and is never uploaded.

Decode and verify

JWT Parser

Decode the header, payload and signature of a JSON Web Token, inspect its registered claims, and optionally verify HS, RS, PS or ES signatures locally. Tokens are never uploaded.

Not verified

Paste a token, then choose Decode token.

About the JWT Parser

Paste a JSON Web Token and the parser splits it into header, payload and signature, pretty-prints each segment and explains the registered claims: issuer, subject, audience, and the exp, nbf and iat timestamps translated into local time with a plain-language description of when they happen. Expired and not-yet-valid tokens are flagged straight away. If decoding is not enough, the verifier checks HMAC signatures against a shared secret and RSA or ECDSA signatures against a PEM public key, all on your device.

What you can do

  • Decode the header, payload and signature of any three-part JWT.
  • Registered claims table with readable dates and expiry status.
  • Verify HS256, HS384 and HS512 with a shared secret.
  • Verify RS256/384/512, PS256/384/512 and ES256/384/512 with a PEM public key.
  • Specific errors for malformed tokens and for encrypted JWE tokens.
  • Copy the decoded header or payload in one click.

How to use the JWT Parser

  1. Paste your token into the JWT Parser tab, or load the built-in HS256 sample.
  2. Choose Decode token to read the header, the claims and the signature bytes.
  3. For signature checking, select Shared secret or Public key PEM, supply the key and verify.

Keyboard shortcut: press Alt+1 to Alt+4 to move between tools, or ⌘K for the command palette.

Frequently asked questions

Is it safe to paste a production token?
The token is decoded entirely in your browser and is never sent anywhere. Treat live bearer tokens as secrets anyway: they grant access until they expire.
Can it verify RS256, PS256 or ES256 tokens?
Yes, if you paste the matching PEM public key in SPKI form. Unsupported algorithms fail with a message listing the algorithms this tool can check.
Why does verification fail with the correct secret?
The secret must match byte for byte, the algorithm in the header must match the key type you selected, and the token must be unmodified — editing any part of a token invalidates the signature even though the payload still decodes.
Where are the expiration details?
The registered claims table shows exp, nbf and iat in your local time with a relative description such as "in 3 hours" or "2 days ago", plus a badge telling you whether the token is currently valid.