JWT Decoder
Decode a JWT and verify HMAC (HS*) and RSA/ECDSA (RS/PS/ES) signatures in-browser — with your secret or a public key — plus a live expiry countdown. Token and keys never leave your device.
🔒 Everything runs in your browser — nothing is ever uploaded. HMAC (HS256/384/512) signatures are verified with your secret and RSA/ECDSA/EdDSA (RS/PS/ES, Ed25519) signatures with the public key you paste, all via the Web Crypto API.
Inspect and verify a JWT without sending it anywhere
Paste a JSON Web Token and instantly see its decoded header and payload, formatted as readable JSON.
Time claims (exp, iat, nbf) are shown as human dates, with a live
countdown to expiry. Enter the secret to verify HS256/384/512 signatures, or paste an
SPKI PEM or JWK public key to verify RS256/384/512, PS256/384/512 and
ES256/384/512 — the RSA/ECDSA algorithms real identity providers (Auth0, Okta, Cognito, Google)
actually sign with. Everything runs entirely in your browser with the Web Crypto API — your token, secret
and key are never uploaded.
Frequently asked questions
Which signatures can it verify?
HMAC (HS256/384/512) with the shared secret, and RSA/ECDSA (RS256/384/512, PS256/384/512, ES256/384/512) with a public key. Paste the public key as an SPKI PEM (-----BEGIN PUBLIC KEY-----) or a JWK — X.509 certificates and PKCS#1 keys are not accepted.
What does a green "verified" actually prove?
Only that the signature matches the key you supplied. It does not check the issuer (iss), audience (aud) or that the token is unexpired — verify those claims separately before trusting a token.
Is my token uploaded?
No. Decoding and verification happen locally in your browser, which matters because a JWT is often a live credential.