JWT Decoder & Debugger: Decode and verify tokens online
The free JWT Decoder & Debugger instantly displays your JSON Web Token’s header and payload in a readable format, with exp, iat, and nbf as UTC dates. Verify the signature with a secret (HS256, HS384, HS512) or a public key in PEM format “BEGIN PUBLIC KEY” (RS, PS, ES), edit claims, and re-sign the token in real time with HS256, HS384, or HS512. Everything runs in your browser; nothing is uploaded.
Built by Jakub Martyniak
Issuing tokens? Run your auth service on your own VPS.
Encoded (JWT)
Decoded
Why this tool
More than a JWT decoder: verify, edit, sign
Everything you need to debug JWTs.
Decode in real time
The header and payload appear as formatted JSON as soon as you paste a token, with no button click needed.
exp, iat & nbf in readable format
iat, nbf, and exp as UTC dates, with time remaining or time since expiry for exp. An expired exp is highlighted in red.
Re-sign with HS256, HS384, HS512
Edit the header or payload, including exp, roles, or custom claims, and get a new token signed with your secret in real time.
Verify RS, PS & ES signatures
Verify RS256 through RS512, PS256 through PS512, and ES256 through ES512 with a public key in PEM format “BEGIN PUBLIC KEY”.
Large numbers remain exact
Integers greater than 2^53, such as Snowflake IDs, are not rounded when decoding and re-signing.
Runs only in the browser
Decoding, signing, and verification use your browser's Web Crypto API—no upload.
JWT structure
Decoding a JWT is not verifying it
A JSON Web Token consists of three Base64URL-encoded parts separated by periods: header.payload.signature. The header and payload are not encrypted; anyone can read them. Only the signature shows whether a token has been altered.
Header
Contains the algorithm (alg) and usually the type (typ). The alg tells the tool whether it needs a secret or a public key for verification.
Payload
Contains claims such as sub, roles, or exp. You can read them at any time, but should only trust them after a successful signature verification.
Signature
Calculated from the header and payload. The tool verifies the signature with your secret (HS256, HS384, HS512) or public key (RS, PS, ES) and displays “Valid” or “Invalid”.
This tool does not generate a strong, random secret for HS256, HS384, or HS512.
Generate a secret with the password generatorexp, iat, and nbf are Unix timestamps in seconds. For custom claims, you need the appropriate numeric value.
Convert timestamps with the Epoch ConverterHow it works
How the JWT decoder works
From pasted token to verified signature in five steps.
Step 1
Paste a JWT
Paste your JWT into the “Encoded (JWT)” field or click “Load example” to test with an HS256 example token.
Step 2
Read the header and payload
In the “Decoded” section, you can immediately see the header and payload as formatted JSON. exp, iat, and nbf appear above the payload as UTC dates.
Step 3
Verify the signature
Enter the secret for HS256, HS384, or HS512, or paste the public key in PEM format “BEGIN PUBLIC KEY” for RS, PS, and ES tokens. “Valid” or “Invalid” will then appear at the top.
Step 4
Edit and re-sign
Optional: Edit the header or payload, or select HS256, HS384, or HS512 as the algorithm. A new token signed with your secret appears in the “Encoded (JWT)” field in real time.
Step 5
Copy result
Copy the token, header, or payload to your clipboard with its copy button.
Explore more
Related tools for JWTs and authentication
Base64 Encoder/Decoder
Encode and decode text in Base64, including a URL-safe variant and clear error messages, entirely in your browser.
Built by Jakub Martyniak
Epoch/Unix Timestamp Converter
Convert Unix timestamps (seconds, milliseconds, microseconds, and nanoseconds) to a readable date and back — with a live ticker, ISO 8601/RFC 2822, and relative time, entirely in your browser.
Built by Jakub Martyniak
Password Generator
Generate strong, random passwords directly in your browser — nothing is stored or transmitted.
Built by Rugile Rutkauskaite
JSON Formatter
Format, minify, and validate JSON with syntax highlighting, error messages, and downloads, entirely in your browser.
Built by Jakub Martyniak
Hash Generator (MD5, SHA-1, SHA-256, SHA-512)
NewGenerate MD5, SHA-1, SHA-256, and SHA-512 hashes from text or files and compare checksums. Runs entirely in your browser.
Built by Luca Stanek
UUID Generator
Generate version 1, 4, 5, and 7 UUIDs individually or in bulk, with customizable formatting, entirely in your browser.
Built by Jakub Martyniak
FAQ
Frequently asked questions about the JWT Decoder
Quick answers about decoding, signature verification, expiration, and privacy.
Yes. The JWT Decoder & Debugger runs directly on this page in your browser, with no account, sign-up, or installation required.
No. Decoding, signing, and signature verification run exclusively in your browser, with cryptography handled by the Web Crypto API. The token, secret, and public key are not uploaded. Real JWTs often contain session or API credentials, though, so test tokens are a better choice for testing.
Yes. A JWT is not encrypted: its header and payload are only Base64URL-encoded and can be read by anyone. The secret or public key is needed only to verify the signature and, for HS256, HS384, and HS512, to re-sign the token. Decoding therefore does not prove a token is authentic; only signature verification does.
For HS256, HS384, and HS512, enter the secret. If the header specifies RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, or ES512, a field for the public key in PEM format “BEGIN PUBLIC KEY” (SPKI) appears instead. The tool does not accept RSA PUBLIC KEY (PKCS#1) or certificates. The result appears at the top as “Valid” or “Invalid”, or “Not verified” without a secret or key. The tool does not verify other algorithms.
If the payload contains exp, iat, or nbf as a number, the tool displays those claims above the payload as UTC dates. For exp, it also shows how long until the token expires or how long ago it expired; an expired exp is highlighted in red. If nbf is in the future, you can see when the token becomes valid.
Yes. Edit the header or payload directly, including exp, roles, or custom claims, or choose another algorithm. As soon as you make a change, a new token signed with your secret appears in the “Encoded (JWT)” field in real time. Signing works only with HS256, HS384, and HS512: RS, PS, and ES algorithms would require a private key, which the tool does not use.
Copy and paste only the part after “Bearer ”. The prefix is not removed automatically, and a JWT must consist of exactly three parts separated by periods (header.payload.signature). With the prefix, the header cannot be read and the tool displays an error.
A JWT consists of three Base64URL-encoded parts separated by periods: a header (e.g. alg and typ), a payload containing the claims, and a signature. The prefilled example shows the structure: an HS256 token with sub, name, and iat that verifies as “Valid” with the example secret.
Any more questions?
Contact SupportYour API needs a reliable server to issue its tokens
A ZAP-Hosting VPS reliably puts your application or project online.
No setup. No risk. Online in seconds.
Looking for more tools? View all developer tools
Preferred source on Google
