• 100% Free
  • No Sign-Up
  • No Credit Card
  • No Free Trial
  • No Pro Tier
  • No Watermarks

Nothing is uploaded. Just open it and start.

Decode and verify JSON Web Tokens, without leaving your browser

Paste any JWT to instantly read its header, payload, and claims, see exactly when it expires, and verify the signature against your secret or public key. No sign-up, no upload — your tokens and keys stay on your machine.

Header, payload & claims

Pretty-printed header and payload with a labelled claims table for iss, sub, aud, exp, and more.

Expiry at a glance

exp, nbf, and iat are shown as readable dates with a clear active / expired / not-yet-valid badge.

Signature verification

Check HMAC secrets or RSA/EC/EdDSA public keys with Web Crypto — right in your browser.

100% private, client-side

Tokens, secrets, and keys never leave your browser. There's no server round trip, ever.

Related tools

Mermaid Studio

Write Mermaid diagrams, preview live, export PNG/SVG, and share with a link.

JSON Formatter

Format, validate, and minify JSON with live error checking and one-click download.

Code Compare

Compare two code snippets or files with a clear, color-coded diff, side-by-side or unified.

Base64 & URL Encoder/Decoder

Encode and decode text with Base64 or URL encoding instantly, entirely in your browser.

Frequently asked questions

Is my token or secret sent to a server?
No. Decoding, claim analysis, and signature verification all happen directly in your browser with JavaScript and the built-in Web Crypto API. Your token, secret, and keys never leave the page — nothing is uploaded, logged, or stored.
What's the difference between decoding and verifying a JWT?
Decoding just Base64URL-decodes the header and payload so you can read them — anyone can do that, since a JWT isn't encrypted. Verifying checks the signature against a secret or public key to prove the token is authentic and hasn't been tampered with. This tool does both.
Which signing algorithms can it verify?
HMAC (HS256, HS384, HS512) using a shared secret, and RSA, RSA-PSS, ECDSA, and EdDSA (RS256, PS256, ES256, EdDSA, and more) using a PEM public key, an X.509 certificate, or a JWK. The algorithm is read from the token header automatically.
How do I check whether a JWT is expired?
Paste the token and the tool reads the exp (expiration) claim, converts it to a readable date, and shows whether the token is still active, expired, or not yet valid (from the nbf claim). It also decodes iat (issued-at).
Why does verification fail even though the token looks correct?
The most common causes are a wrong or mistyped secret, using the private key instead of the public key for RSA/EC tokens, or an algorithm mismatch. Verification checks only the signature here, so an expired-but-authentic token still reports a valid signature — expiry is shown separately.
Is the JWT Decoder really free?
Yes. No sign-up, no payment details, no expiry, and no locked features. Decode and verify as many tokens as you like. A single unobtrusive ad slot covers hosting.