JWT Decoder

Decode JSON Web Token headers and payloads, inspect expiration, and verify HS256, RS256, or ES256 signatures.

Decoding happens locally in your browser.

Header

Decoded header will appear here.

Payload

Decoded payload will appear here.

Signature

Encoded signature will appear here.

Provide the matching key to check the signature. RS256 and ES256 require a PEM public key in SPKI format.

Inspect a JSON Web Token

A JWT contains a header, a payload, and a signature, encoded as three Base64url segments separated by dots.

Decoding reveals the token contents but does not prove they are trustworthy. Signature verification checks the signed header and payload with the supplied key. Expiration is reported from the payload's exp claim.

When to use it

Inspect claims and check a token signature while debugging an authentication flow. Treat decoded claims as untrusted until you verify the signature.