JWT Decoder
Decode and verify JSON Web Tokens locally.
Runs in your browser. Your file is never uploaded.
Decoded on your device; the token is never sent anywhere.
How to use JWT Decoder
- 1Paste a JWT.
- 2Read the decoded header, payload and expiry times.
- 3Optionally paste the secret or public key to verify the signature.
Questions
Is it safe to paste a real token here?
The token is decoded and verified in this page and never sent anywhere. Still treat tokens like passwords: a valid token grants access until it expires.
Which algorithms can it verify?
HS256/384/512 with a shared secret, and RS, PS, ES and EdDSA algorithms with a PEM public key, an X.509 certificate or a JWK.
Does decoding prove a token is genuine?
No. Anyone can create a token with any payload. Only a successful signature check with the right key shows it came from the issuer.
Are my files uploaded anywhere?
No. The tool runs as code in your browser tab and processes the file on your own device. Nothing is sent to a server, and the site's security policy blocks the page from sending data to any other website. You can check: open your browser's developer tools, watch the Network tab while the tool runs, and you'll see no upload.