JWT Decoder: View Header, Payload, Expiry and Verify the Signature (HS256 RS256 ES256)
Paste a token (a leading "Bearer" is fine). Decoding only reads data that anyone can read; it does not prove the token is genuine. Only checking the signature with a key does, and the key box is below. Everything stays in your browser.
Part of the suite: Developer tools
Header
Payload
FAQ
Does decoding a JWT mean it is genuine?
No. The header and payload are only Base64-encoded, so anyone can read them. Authenticity rests on the signature, which must be checked on the server with the secret or public key.
Is it safe to paste a token here?
The token never leaves your browser. Still, treat a live token like a password; use test or expired tokens when you can.
Which algorithms can it verify?
HS256/384/512, RS256/384/512 and ES256/384. PS* and EdDSA are not supported yet.
Help us improve
Found a bug, want a feature, or have an idea? Tell us here. Every message is read.