What is JWT Decoder?
JWT Decoder reads a JSON Web Token and shows you exactly what is inside: the header (algorithm and token type), the payload claims, and the signature. Standard claims like exp, iat and nbf are turned into readable dates, and the token is clearly marked as valid, expired or not yet valid.
You can also verify the signature: paste the shared secret for HS256/384/512 tokens, or a public key (PEM or JWK) for RS, PS and ES tokens. Tokens often carry user IDs, emails and permissions, so this decoder runs entirely in your browser with the Web Crypto API — nothing you paste is sent anywhere.
How to use JWT Decoder
Get it done in 4 simple steps — no installation or account needed.
- Paste a JWT into the token box (a “Bearer ” prefix is removed automatically), or click Sample to try one.
- Read the decoded header and payload. Expiry and issue dates are shown in your local time with a valid/expired badge.
- To verify the signature, paste the HMAC secret or the issuer’s public key (PEM or JWK) into the verification box.
- Copy the decoded header or payload JSON with one click.
Limitations & supported browsers
Works in the latest Chrome, Edge, Firefox, Safari (Mac, iPhone and iPad) and Samsung Internet. Because processing happens on your device, speed and maximum file size depend on your device’s memory.
- Signed tokens (JWS) only. Encrypted tokens (JWE, five dot-separated parts) can’t be decoded without the private key.
- Signature verification supports HS256/384/512, RS256/384/512, PS256/384/512 and ES256/384/512. EdDSA and “none” tokens are decoded but not verified.
- Verification checks the signature only. Your server should also check the issuer, audience and expiry.
Who needs JWT Decoder?
From students to professionals, here’s who gets the most out of JWT Decoder — and why.
Backend developers
Debug authentication flows and check which claims a token actually contains.
Frontend developers
Inspect tokens from OAuth or OpenID Connect providers like Auth0, Cognito, Firebase or Keycloak.
QA & support engineers
Find out why a request returns 401 — expired token, wrong audience or bad signature.
Security learners
See how JWTs are structured and why a decoded token isn’t automatically trustworthy.
Is JWT Decoder safe to use?
Yes. JWT Decoder runs entirely in your web browser using JavaScript. Your files and data are processed on your own device and are never uploaded to AppsOcean or any third-party server. There’s nothing to install, no account to create, and it’s completely free.Read our privacy policy.
JWT Decoder — frequently asked questions
Does decoding a JWT mean it is valid?
No. Anyone can decode a JWT — the header and payload are only Base64URL-encoded. A token is only trustworthy if its signature verifies with the right key and its expiry and audience checks pass.
Is it safe to paste a real token here?
Decoding happens entirely in your browser and nothing is sent to a server. Still, treat live tokens like passwords: prefer test tokens, and never share production tokens or secrets in tickets or chats.
Are my files uploaded to a server?
No. Everything is processed locally in your browser using JavaScript. Your files never leave your device, and nothing is stored on our side.
Last updated