JWT decoder & verifier — offline, your token never leaves the browser
Decode the header and payload, check expiry at a glance, and verify HMAC/RSA/ECDSA signatures with WebCrypto — all offline.
Decode a JWT offline, without pasting it into someone else's server
A JSON Web Token is a bearer credential. Whoever holds it can act as the user it was issued for, until it expires. That makes pasting a production token into an online decoder a genuine security event: the token travels to a third-party server, lands in that server's request logs, and passes through whatever CDN, proxy, and analytics stack sits in front of it. Most online decoders are honest about not storing tokens — but "we don't log it" is a promise you cannot audit.
This decoder takes a different approach. It is a static page with no backend to send anything to. The token is parsed and verified by JavaScript running in your tab, and the site's Content-Security-Policy blocks requests to third-party origins outright. You do not have to take our word for it: open DevTools → Network, paste a token, and watch that no request is made. Or disconnect from the internet — the decoder keeps working, because there was never a server involved.
If a token has already been pasted somewhere you do not control, treat it as compromised and rotate it. Decoding it here afterwards does not undo that exposure.
What is inside a JSON Web Token
A JWT is three base64url-encoded segments joined by dots: header.payload.signature. Base64url is not encryption — it is an encoding, so anyone holding the token can read the first two segments without any key at all. That is the single most important thing to understand about JWTs: never put a secret in a payload.
- Header — the signing algorithm (
alg, e.g.HS256) and token type. This tool shows the algorithm next to the decoded header so you can see at a glance what the issuer used. - Payload — the claims. Registered claims like
iss,sub,aud,exp,iat, andnbfhave standard meanings; everything else is application-specific. - Signature — computed over
header.payloadwith the issuer's key. It is what makes the token tamper-evident, and it is the only part that requires a key to check.
If the token you paste does not have exactly three dot-separated parts, or a segment is not valid base64url JSON, you get a specific error saying which — rather than a blank screen. For the longer explanation, see what a JWT is and how it works, or use the Base64 decoder to inspect a single segment by hand.
Verify a JWT signature in the browser: HS256, RS256, and ES256
Decoding proves nothing about authenticity — it only reveals what the token claims. Verification is the step that proves the token was issued by the holder of the key and has not been modified since. This tool verifies signatures with your browser's built-in WebCrypto API, so the secret or public key you supply stays on your device exactly like the token does.
- HS256, HS384, HS512 — HMAC with a shared secret. Paste the same secret string the issuer signs with.
- RS256, RS384, RS512 — RSA signatures. Paste the issuer's PEM public key (the
BEGIN PUBLIC KEYblock), never the private key. - ES256, ES384 — ECDSA on the P-256 and P-384 curves, also verified from a PEM public key.
The form switches between the secret field and the PEM field automatically based on the alg in the header, and the result is unambiguous: a green "Signature valid" or a red "Signature INVALID". An invalid result on a token you expected to be good usually means a key mismatch, a rotated key, or a token that was copied with a truncated signature segment.
Check whether a token has expired: exp, iat, and nbf
JWT time claims are NumericDate values — seconds since the Unix epoch, not milliseconds — which is why they are unreadable at a glance and why an off-by-1000 bug is one of the most common JWT mistakes. Whenever a token carries exp, iat, or nbf, this decoder renders a table showing the raw number alongside your local date and a relative time such as "in 58 minutes" or "3 days ago".
An expired token is called out immediately with a red banner above the decoded panes, so the most common cause of a 401 is the first thing you see rather than something you work out from arithmetic. nbf matters too: a token with a not-before timestamp in the future is rejected by a correct server even though it has not expired, which is a frequent symptom of clock skew between services.
Related tools that also run entirely on your device: Unix timestamp converter for the raw values, and JSON formatter for a large decoded payload.
How to decode and verify a JWT offline
- 1
Paste a JWT — header and payload decode instantly.
- 2
Check the claims table: expiry, issued-at, and validity window.
- 3
Optionally verify the signature with your secret or public key.
JWT Decoder — frequently asked questions
Is it safe to paste a real JWT here?
Yes — and that's the point of this tool. The token is decoded and verified by code running only in your browser; it is never transmitted anywhere. Our Content-Security-Policy blocks third-party requests, and you can verify in DevTools → Network.
Can it verify signatures like jwt.io?
Yes. HS256/384/512 with your shared secret, and RS256/384/512 or ES256/384 with a PEM public key — all via your browser's WebCrypto, entirely offline.
Why does it warn about my token's expiry?
The exp, iat, and nbf claims are decoded and shown as human-readable times, with a clear badge when the token is already expired or not yet valid.
JWT Decoder guides
How to verify a JWT signature
Decoding a JWT proves nothing — verifying the signature is what makes it trustworthy. How HS256 and RS256 verification actually work, and how to check a token without handing it to a third-party server.
Is this JWT still valid?
A valid signature does not mean a valid token. What exp, nbf, and iat actually mean, why clock skew breaks logins, and which claims you must check before trusting a request.
JWT signing algorithms compared
Symmetric versus asymmetric signing, which algorithm to pick for which architecture, and why the alg header is the most security-critical field in the whole token.
What is a JWT, and how do you decode one safely?
A plain-English guide to JSON Web Tokens: what the three parts mean, how signature verification works, and why you should never paste a token into a random website.