← Tools

JWT Decoder

Read what's inside a JWT and check that it's genuine.

Private: your files never leave your device.

Your token and keys stay on this device. Nothing is sent anywhere.

How it works

  1. Choose your files.
  2. Adjust the settings if you like.
  3. Download the result, or send it to another device with BroAllDone.

Frequently asked questions

How do I decode a JWT?

Paste the token. Its header and payload appear straight away, with every claim explained and times like exp and iat shown as dates.

Can it tell if the token has expired?

Yes. You see whether it is valid, expired or not valid yet, and when it expires, for example in 2 hours.

How do I verify the signature?

Paste the secret for HS256, HS384 or HS512, or the public key for RS, PS, ES and EdDSA tokens: a PEM key, a certificate, a JWK or a whole JWKS. The right key is picked by its kid.

Is it safe to paste my token here?

Yes. Decoding and verifying happen in your browser, so your token and keys never leave your device. Still, treat live tokens like passwords.

Why does it say the token isn't signed?

The header says alg: none, so anyone could have written it. Never accept such a token as proof of anything.

What about encrypted tokens?

A JWE has five parts instead of three. Its header is shown, but the contents can only be read with the private key.

More free tools