Security & Crypto
JWT Decoder & Signer
Decode JWTs, check expiry, verify HS, RS, PS, ES and EdDSA signatures, and sign HMAC tokens.
Loading the JWT Decoder & Signer…
About the JWT Decoder & Signer
Decode a JSON Web Token to read its header and claims, see when it was issued and when it expires, and verify its signature with a secret or a PEM/JWK public key. HS, RS, PS, ES and EdDSA algorithms are supported, and you can sign new HMAC tokens for testing. Tokens never leave your browser, which matters when they are real credentials.
How to use it
- Paste the token.
- Read the decoded header, payload and expiry status.
- Enter the secret or public key to verify the signature.
Frequently asked questions
- Is it safe to paste a production JWT here?
- Yes, in the sense that the token is decoded and verified only in your browser; it is never sent anywhere. As with any credential, avoid sharing your screen while it is visible.
- Why does my token fail verification?
- The secret or public key does not match, the algorithm in the header differs from the key type, or the token was modified. For HS tokens, check whether the secret is Base64-encoded.
- Can it decode encrypted JWTs (JWE)?
- No. Encrypted tokens have five parts and need the decryption key; this tool decodes and verifies signed tokens (JWS).