Skip to content
♥ Donate

JWT decoder & verifier — your token never leaves the browser

Decode the header and payload, check expiry at a glance, and verify HMAC/RSA/ECDSA signatures with WebCrypto — all offline.

100% private — files never leave your device
JWT

How it works

  1. 1

    Paste a JWT — header and payload decode instantly.

  2. 2

    Check the claims table: expiry, issued-at, and validity window.

  3. 3

    Optionally verify the signature with your secret or public key.

Related tools

Base64 Encode/DecodeText and files, standard or URL-safe, fully UTF-8 aware.URL Encoder/DecoderPercent-encode query values or decode messy URLs.HTML EntitiesEscape markup or decode entities back to readable text.Number Base ConverterBinary, octal, decimal, hex — exact BigInt conversion.

Frequently asked questions

Is it safe to paste a real JWT here?

Yes — and that's the point of this tool. The token is decoded and verified by code running only in your browser; it is never transmitted anywhere. Our Content-Security-Policy blocks third-party requests, and you can verify in DevTools → Network.

Can it verify signatures like jwt.io?

Yes. HS256/384/512 with your shared secret, and RS256/384/512 or ES256/384 with a PEM public key — all via your browser's WebCrypto, entirely offline.

Why does it warn about my token's expiry?

The exp, iat, and nbf claims are decoded and shown as human-readable times, with a clear badge when the token is already expired or not yet valid.