Decode JSON Web Tokens

Paste a token to securely inspect its Header, Payload, and Signature.

Decoding & verification is 100% client-side. Your secrets and tokens never leave your browser.

Header

Algorithm & Token Type 
{...}

Payload

Data (Claims) 
{...}

Signature

Verification Hash 
...

Understanding JWT Structure

Header

Consists of the token type (JWT) and the signing algorithm such as HS256 or RS256. It is color-coded red in the visualizer.

Payload

Contains the claims — statements about the user plus metadata like expiration time. It is color-coded purple in the visualizer.

Signature

Used to verify that the sender of the JWT is who it claims to be and that the message has not been tampered with. It is color-coded blue in the visualizer.

Frequently Asked Questions

Is my JWT token sent to a server when I decode it?

No. Your JWTs are decoded 100% locally in your browser using JavaScript. No tokens, signatures, or payload data are ever logged, sent to any server, or persisted off-device. Our client-side architecture ensures maximum privacy for sensitive diagnostic tasks.

How do I verify a JWT signature client-side?

This tool uses the native browser Web Crypto API to cryptographically verify signatures locally. Simply paste your token, and if the algorithm is supported (like HS256 or RS256), a 'Verify Signature' panel will appear automatically. Enter your secret or public key, and it will instantly validate the token's cryptographic integrity without network calls.

Can a JWT contain sensitive data like passwords or PII?

No, you should never place sensitive information (like passwords, social security numbers, or highly sensitive PII) in a standard JWT. Standard JSON Web Tokens (JWS) are only Base64Url encoded, meaning anyone who intercepts the token can decode and read the payload. You should only include non-sensitive identifiers and authorization claims.

Why is my JWT signature showing as invalid?

Common reasons for invalid JWT signatures include: using the wrong secret key, mismatched algorithms between the header and the verification logic, trailing whitespaces in your PEM certificate, or the token payload being tampered with after it was originally signed.

What algorithms does this JWT decoder support for verification?

Our client-side cryptographic signature verification currently supports standard HMAC-based algorithms (HS256, HS384, HS512) and RSA-based algorithms (RS256, RS384, RS512). The tool parses the token header to detect the algorithm automatically.

How does the tool handle JWT timestamps like iat, exp, and nbf?

Standard JWTs use Unix epoch integers for timestamps which are inherently difficult to read. This tool automatically detects standard time claims and converts them into localized, human-readable relative formats (e.g., 'Expires in 2 hours'). Hovering over the timestamp badge reveals the exact UTC ISO string.

What if my JWT payload contains emojis or international characters?

Unlike basic decoders that fail or mangle UTF-8 characters via deprecated decoding methods, this tool uses a modern, spec-compliant TextDecoder approach that correctly parses accents, symbols, and emojis hidden inside Base64Url encoded payloads.

What is the difference between JWS and JWE?

JWS (JSON Web Signature) represents signed content, ensuring the data has not been modified in transit. JWE (JSON Web Encryption) represents encrypted content, ensuring confidentiality so the payload cannot be read. This tool decodes standard JWS tokens.