JWT decoder & encoder
Decode, verify and sign JSON Web Tokens in your browser. Paste a token to read its claims and check its signature - nothing you paste here is sent anywhere.
How it works
Readable by anyone. Trustworthy once verified.
Never leaves your browser
Tokens are decoded and verified on this page, and keys never leave it. That matters: a JWT is often a live credential, and so is the key that signs it.
Decoding is not verifying
A JWT's header and payload are base64url, not encrypted, so anyone can read them. Act on the claims only once the signature checks out against a key you trust.
Every common algorithm
HMAC, RSA, RSA-PSS, ECDSA and EdDSA, using your browser's own Web Crypto. Keys as PEM, a certificate, a JWK or a JWK set.
Common questions
Is it safe to paste a production JWT here?
Nothing you paste is sent to a server: decoding and verifying run in this browser tab. Still treat a live token like a password - anyone who has it can use it until it expires - so prefer tokens from a test environment where you can.
Why does my token show an invalid signature?
Usually the wrong key: a different secret, the public key from another environment, or a key that was rotated after the token was issued. Compare the kid in the header with the key you are using. For HMAC, check whether your secret is stored base64url-encoded and set the switch to match.
What is the difference between decoding and verifying a JWT?
Decoding only reads the token: the header and payload are base64url, not encrypted, so anyone holding a JWT can read its claims. Verifying checks the signature against a key you trust. Act on the claims only after the signature checks out.
What does alg none mean?
The token is unsigned, so anyone could have written everything in it. A server must never accept alg none, and the decoder flags it. If a library you use accepts it, upgrade the library.
Which algorithms and key formats are supported?
HS256, HS384 and HS512 with a secret as text or base64url; RS256 to RS512 and PS256 to PS512 with RSA keys; ES256, ES384 and ES512 with EC keys; and EdDSA with Ed25519 keys. Keys can be PEM (SPKI, PKCS#8, PKCS#1, SEC1 or an X.509 certificate) or a JWK, including a JWK set, where the key is picked by the token's kid.
How should I send a JWT to someone?
As you would a password: not in a chat thread or a ticket, where it stays readable for as long as they exist. Share it as a one-time link that burns after reading.