Home›Developer Tools›JWT Decoder
🔏

JWT Decoder & Signature Verifier

Inspect JSON Web Token structure, interpret registered claims, detect expiry and verify supported HMAC or RSA signatures locally.

Claim analysisHS verificationRSA public keysNo token upload

JWT inspection workspace

Decoding shows token contents. Only successful signature verification provides cryptographic authenticity.

Private local processing
Encoded JWT0 characters
Token data stays in this browser. Avoid pasting active production credentials into any tool unless necessary.
Algorithm—
Token type—
Expiry state—
Encoded size—
Header
Payload
Signature segment
Security reminder: a well-formed or decoded JWT is not necessarily trustworthy. Applications must verify the signature, expected algorithm, issuer, audience, time claims and other authorization rules.
Inspect JWTs without confusing decoding with trust
A JSON Web Token normally contains a Base64URL-encoded header, payload and signature. Header and payload data are readable by anyone holding the token; they are encoded, not encrypted.
Decode structure
Review the declared algorithm, token type and JSON claims without sending the token to a server.
Verify authenticity
For supported algorithms, verification confirms the signature matches the signing input and supplied key.
Validate application rules
A valid signature does not automatically prove the issuer, audience, permissions or business context are acceptable.
How to use the JWT decoder
  1. Paste a compact three-part JWT and press Decode token.
  2. Inspect the header, payload and registered-claim timing analysis.
  3. For HS algorithms, enter the exact shared secret. For RSA algorithms, enter the PEM public key.
  4. Verify the signature, then independently confirm issuer, audience and authorization requirements.
Supported verification algorithms
The verifier supports HS256, HS384 and HS512 with shared secrets; RS256, RS384 and RS512 with SPKI PEM public keys; and PS256, PS384 and PS512 with RSA-PSS public keys. Decoding remains available for other JWT algorithms, but verification is reported as unsupported.
Frequently Asked Questions
Does decoding a JWT validate it?
No. Decoding only reveals Base64URL data. Authenticity requires signature verification and application-level validation of claims such as issuer, audience and expiry.
Are JWT payloads secret?
Usually not. Standard signed JWTs are readable by anyone who possesses them. Do not place secrets in the payload unless the token is separately encrypted using JWE.
Can I paste a private RSA key?
This verifier requires a public key for RSA verification. Never paste a production private signing key into a web tool.
What does the alg none value mean?
It represents an unsecured JWT with no cryptographic signature. Security-sensitive applications should reject it unless an exceptionally narrow and intentional design requires it.