Tools › Developer tools

JWT decoder

Decode JSON Web Tokens, check expiry and verify HS256, RS256, PS256 and ES256 signatures with WebCrypto, right in your browser.

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MDIxIiwibmFtZSI6Ik5pYmJvIiwicHJvIjp0cnVlLCJpYXQiOjE3OTE4MDAwMDAsImV4cCI6MTc5MTgwMzYwMH0.3gyjX84nuxuPoVGw5Q01DBQ2lSFvvfCYp3da6-4BhHM

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "4021",
  "name": "Nibbo",
  "pro": true,
  "iat": 1791800000,
  "exp": 1791803600
}

Algorithm: HS256
Issued: 10/12/2026, 10:13:20 AM
Expires: 10/12/2026, 11:13:20 AM expired

Secret

nibbo

How it works

The header and payload are Base64URL-decoded locally.
Signatures are checked with the browser’s built-in WebCrypto. Secrets and keys stay in this tab.
Tokens with "alg": "none" are always reported as unverified.

Questions

Why does it matter that decoding is local?

A JWT is often a live session. Pasting it into a site that logs requests hands over access to your account.

Which key formats work?

A shared secret for HS*, or a public key as PEM (SPKI) or JWK for RS*, PS* and ES*.