JWT Decoder

A JSON Web Token (JWT) packs a header, a payload of claims and a signature into three Base64URL parts joined by dots. This decoder shows the header and payload as readable JSON, turns the time claims into dates, and can verify the signature if you paste the secret or public key. The token never leaves your browser.

How to use this tool

1. Paste the token.
2. Read the pretty-printed header and payload.
3. Check the iat, nbf and exp claims against the current time.
4. Optionally paste the HMAC secret or a PEM/JWK public key to verify the signature.

Formula

The signature is computed over "header.payload" (the first two Base64URL segments). HS256 uses HMAC-SHA-256 with a shared secret; RS/PS/ES use RSA or ECDSA with a public key.

Decoding is not the same as trusting: anyone can read a JWT. Only a valid signature proves it was issued by the holder of the key.

Example

The classic sample token decodes to a payload of { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }, and with the secret "your-256-bit-secret" its HS256 signature verifies as Valid.