Free JWT DecoderDecode, verify and sign JSON Web Tokens.

Paste a token to see its header and claims, with expiry and issue times as real dates.
Check the signature with a secret or public key, or sign a new token for testing.

Tokens stay in your browserSignature checkReadable expiry

No sign-up No upload No limits

Tokens and keys never leave your browser.

Token

Or try an example

Decoded

The header, payload and claims appear here.

Tokens and keys stay on your device.

THREE SIMPLE STEPS

How to decode a JWT

Paste the token

Paste a JWT, with or without “Bearer”. The header and payload are decoded straight away.

Read the claims

See who issued it, for whom, and when it expires, as dates in your time zone with “in 2 hours” or “3 days ago”.

Verify the signature

Enter the secret or paste the public key, certificate or JWKS to check the token wasn’t changed.

WaveSpeed AI

Building something with an API?

Generate images, video and 3D models from your own code with WaveSpeed AI.

Start creating Explore 1,000+ AI Models

1,000+ AI models
Image, video and 3D
Pay as you go

$1 in free credits for eligible new accounts. No card needed. Generators have separate account and credit requirements. The JWT decoder is free.

JWT Decoder FAQ

Is it safe to paste a real token here?

The token, secret and keys are processed in your browser with its built-in cryptography and are never sent anywhere. Even so, a live token works like a password until it expires, so prefer test tokens and never share one in chats or tickets.

Which algorithms can it verify?

HS256, HS384 and HS512 with a shared secret; RS256/384/512 and PS256/384/512 with an RSA public key; ES256, ES384 and ES512 with an EC public key; and EdDSA (Ed25519) in browsers that support it. Keys can be a PEM public key, an X.509 certificate, a JWK or a JWKS (picked by the token’s kid).

Does decoding prove a token is genuine?

No. Anyone can read a JWT, because the header and payload are only encoded, not encrypted. Only a valid signature shows it was issued by the key holder and not changed.

What is alg “none”?

An unsigned token. Servers must never accept it, and this tool never reports it as verified.

Why does my expiry show a date far in the future?

exp, iat and nbf must be seconds since 1970. A value in milliseconds is 1,000 times too large; the decoder warns when it sees one.

Can I create tokens?

Yes. Switch to Encode, edit the header and payload, and sign with a secret (HS256/384/512) or a private key in PEM or JWK form. Quick buttons set iat and exp.

Are encrypted tokens (JWE) supported?

No. A JWE has five parts and needs the recipient’s private key to read; this tool decodes and verifies signed tokens (JWS).

All Free Tools