There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to decode a JWT
- Paste the token. Drop the JWT into the input — it splits into header, payload, and signature.
- Read the claims. The header and payload are shown as formatted JSON, with exp/iat rendered as dates.
- Verify (optional). Add the HMAC secret or a public key (PEM, PKCS8, or JWK) to check the signature.
- Confirm validity. See whether the signature matches and whether the token is expired.
A JWT carries three Base64URL parts — header, payload, signature — and debugging auth usually means reading the middle part and confirming the last one. This decoder does both without a round-trip: claims render as formatted JSON with the time fields turned into dates, so an "expired token" bug is obvious at a glance.
Verification is where a real key comes in. Symmetric tokens (HS*) verify against a shared secret; asymmetric ones (RS/PS/ES/EdDSA) verify against the issuer's public key in PEM, PKCS8, or JWK form. A green check means the payload hasn't been tampered with.
Need related crypto? Inspect the certificate behind a public key with the X.509 decoder, reshape keys with the Key converter, or generate a fresh pair with the Key pair generator.
Frequently asked questions
How do I decode a JWT?
Paste the token and its header and payload are Base64URL-decoded and shown as JSON. Decoding needs no key — a JWT is signed, not encrypted, so anyone holding it can read the claims.
Can I verify the signature, not just read it?
Yes. Supply the HMAC shared secret for HS256/384/512, or the public key (PEM/SPKI, PKCS8, or JWK) for RS/ES/EdDSA tokens, and the tool checks whether the signature is valid.
Is it safe to paste a real token here?
Access tokens are sensitive, so this matters: the token is processed only in this tab and there is no upload endpoint to receive it. You can confirm that in your browser's network panel.
Why does my token show as expired?
The exp claim is a Unix timestamp; if it's earlier than now the token is past its lifetime. The decoder shows exp and iat as human dates so this is easy to spot.