How to use
Paste your token
Paste the full JWT into the JSON Web Token box; a Bearer prefix is fine. Try sample loads a signed HS256 token and its secret, so you can see a verified result straight away.
Verify with a secret or public key
Paste the secret, ticking Secret is Base64-encoded if your provider gives it that way, or paste the issuer's public key, certificate, JWK or JWKS. A green or red notice says whether the signature matches.
Read the claims or build a token
Claims explained lists every header and payload field with its meaning, and time claims as dates. Switch to Encode and sign to create a test token, then click Open in decoder to check it.
Why JWT Decoder
- Verifies HS, RS, PS, ES and EdDSA signatures with a secret, PEM key, certificate, JWK or JWKS.
- Explains each claim and shows iat, nbf and exp as readable dates.
- Encodes and signs test tokens, with a key pair generator for RSA, EC and EdDSA.
- Runs in your browser, so tokens and keys are never sent anywhere.
JWT structure and the standard claims
A JWT is three base64url strings joined by dots: header.payload.signature. The header says which algorithm signed the token, such as HS256 or RS256. The payload holds the claims, which are simple key and value pairs about the user and the token. The signature is computed over the first two parts, so changing even one character of the header or payload makes it invalid.
Because the header and payload are only encoded, never put secrets such as passwords in them. RFC 7519 defines a short list of registered claims that most libraries understand. Your auth server can add any other claims it needs, such as roles or an email address.
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who created and signed the token |
| sub | Subject | Who the token is about, usually a user ID |
| aud | Audience | Which service the token is meant for |
| exp | Expiration time | Unix time after which the token is invalid |
| nbf | Not before | Unix time before which the token is invalid |
| iat | Issued at | Unix time when the token was created |
| jti | JWT ID | Unique ID, used to stop a token being replayed |
Keys you can verify with
The key box accepts the formats identity providers and libraries hand out. The algorithm comes from the token's header, so you only paste the key.
| Algorithm in the header | Paste this | Example source |
|---|---|---|
| HS256, HS384, HS512 | The shared secret, as text or Base64 | Your app's JWT_SECRET setting |
| RS256, RS384, RS512, PS256, PS384, PS512 | PEM public key, X.509 certificate, JWK or JWKS | Auth0, Okta, Microsoft Entra ID, Firebase |
| ES256, ES384, ES512 | PEM public key, JWK or JWKS | Apple, Google and many API gateways |
| EdDSA (Ed25519) | PEM public key or JWK | Newer services; needs a browser with Ed25519 support |
| none | Nothing: the token is unsigned and must be rejected | Misconfigured or forged tokens |