Does this tool verify the JWT signature?

Yes, when you ask it to. Enter the secret for HS256/384/512, or a public key (PEM or JWK) for RS, PS and ES algorithms, and press Verify. Until you do, the page clearly says the signature is not verified — decoding alone proves nothing.

Is my token sent to a server?

No, decoding happens entirely locally in your browser using Base64URL decoding.

What does the exp claim mean?

exp is a Unix timestamp for when the token expires. The tool shows it as a date with a live “in 2 hours” or “3 days ago” countdown.

Can I use this to check if a token is expired?

Yes. The badges show Expired, Not valid yet (nbf) or Not expired. These only describe the time claims, not whether the token is genuine.

What algorithm does the header show?

The decoded header includes the alg field, such as HS256 or RS256, indicating what algorithm the token was signed with — this is metadata only and isn't used to verify anything here.

Can I decode a malformed or truncated JWT?

No. A signed JWT has three dot-separated Base64URL parts that decode to JSON; the tool tells you which part is wrong. Encrypted tokens (JWE, five parts) cannot be decoded here.

Are custom claims in the payload displayed?

Yes, all claims in the payload are shown, both registered claims like iss and sub and any custom claims your application added.

Are my tokens or keys stored anywhere?

No. Everything happens in your browser and, unlike most tools here, tokens and keys are never saved to your history.

Processed 100% locally in your browser

JWT Decoder

Decode a JWT, read its claims in plain language, and verify the signature with your secret or public key — 100% local, never stored.

Quick Answer

JWT Decoder lets you: Decode a JWT, read its claims in plain language, and verify the signature with your secret or public key — 100% local, never stored. To start, paste the token — a leading "Bearer " is fine.

Loading tool…

How to use this tool

1
Paste your JWT
Paste the token — a leading "Bearer " is fine.
2
Read the decoded parts
The header and payload appear as JSON, with the token colour-coded and exp, nbf and iat shown as readable dates.
3
Check the time claims
See whether the token is expired or not yet valid, with a live countdown.
4
Verify the signature
Enter the shared secret (HS) or paste the public key as PEM or JWK (RS, PS, ES) and press Verify.

Frequently Asked Questions

Base64 Encoder

Encode and decode Base64 text and files, with UTF-8, URL-safe and data: URI support — processed 100% locally in your browser.

Hash Generator

Generate MD5, SHA and CRC32 hashes of text or files and verify a checksum — processed 100% locally.

JWT Decoder

How to use this tool

Paste your JWT

Read the decoded parts

Check the time claims

Verify the signature

Frequently Asked Questions

Does this tool verify the JWT signature?

Is my token sent to a server?

What does the exp claim mean?

Can I use this to check if a token is expired?

What algorithm does the header show?

Can I decode a malformed or truncated JWT?

Are custom claims in the payload displayed?

Are my tokens or keys stored anywhere?

Related Tools

Base64 Encoder

Hash Generator

JWT Decoder

How to use this tool

Paste your JWT

Read the decoded parts

Check the time claims

Verify the signature

Frequently Asked Questions

Does this tool verify the JWT signature?

Is my token sent to a server?

What does the exp claim mean?

Can I use this to check if a token is expired?

What algorithm does the header show?

Can I decode a malformed or truncated JWT?

Are custom claims in the payload displayed?

Are my tokens or keys stored anywhere?

Related Tools

Base64 Encoder

Hash Generator