JWT Decoder

Decode JWT header and payload, and optionally verify signatures for HS* and RS* algorithms.

JWT Decoder

Decode JWT header and payload, and optionally verify HS*/RS* signatures.

Settings Prefilled example
Decoding shows content. Verification checks the signature when you provide a secret or public key.
Tip: avoid pasting production secrets into shared environments.
Result Copy-ready
No output yet
Paste a JWT and click Generate.
Copied

About JWT Decoder

JWT Decoder Tool for Decoding JSON Web Tokens

A JWT (JSON Web Token) is a compact string that carries signed claims between systems. This JWT Decoder helps you quickly decode a token into its header and payload, highlight common claims, and (optionally) verify the signature when you provide the appropriate key.

How JWT Decoder Works

JWTs are made of three base64url-encoded parts separated by dots: header, payload, and signature. Decoding is simply reversing base64url and parsing JSON. Verification is separate: it checks whether the signature matches the header+payload using the algorithm and key you specify.

Step-by-step

  • 1) Paste your token: Add a JWT in the input box. The tool accepts standard three-part tokens and also handles “missing signature” tokens for inspection.
  • 2) Decode safely: The tool base64url-decodes the header and payload, parses JSON, and shows readable, pretty-printed output.
  • 3) Review claims: It surfaces common fields such as iss, aud, sub, exp, nbf, iat, and jti, and provides warnings for likely issues (for example, an expired token).
  • 4) Optional verification: Switch to “Verify signature”, choose (or auto-detect) an algorithm, then paste either an HMAC secret (HS256/HS384/HS512) or an RSA public key (RS256/RS384/RS512).
  • 5) Copy or download results: Copy the combined report to your clipboard or download it as a TXT file for audits, tickets, or documentation.

Key Features

Instant header and payload decoding

See the decoded JSON in a clean, readable format. This is ideal for quickly checking the alg, kid, and typ fields in the header and the set of claims in the payload.

Optional signature verification (HS* and RS*)

If you have the secret or public key, you can verify whether the signature matches the token. The tool supports common HMAC algorithms (HS256/384/512) and RSA algorithms (RS256/384/512) using PHP’s built-in cryptography functions.

Claim hints and time checks

The decoder interprets Unix timestamps for exp, nbf, and iat and flags likely problems such as an expired token or a token that is not yet valid. This helps you troubleshoot authentication issues faster.

Pretty-print and raw-safe outputs

Switch between pretty JSON and compact JSON output. The tool never executes token content; it only decodes and formats text for display and copying.

Privacy-first workflow

JWTs often contain sensitive identifiers. Use decoding for inspection and debugging, but avoid pasting production tokens into shared environments. When possible, test with non-sensitive samples or redact values before sharing results.

Use Cases

  • Debugging login issues: Confirm that iss, aud, and exp match what your API expects.
  • Checking token expiration: Quickly see whether a token is expired, not yet valid, or has an unexpected lifetime.
  • Auditing headers: Verify the algorithm in alg and key identifiers like kid during security reviews.
  • Validating signature setups: Test whether your HS* secret or RSA public key matches the token you’re issuing.
  • Customer support tickets: Produce a readable report (without secrets) to speed up diagnosis and communication.
  • Learning and training: Understand how JWT structure maps to claims and why signature verification matters.

Whether you’re working on a small web app or a multi-service platform, a dependable JWT decoder reduces guesswork. It turns an opaque token string into a clear set of fields you can validate against your configuration.

Optimization Tips

Prefer short-lived access tokens

Keep access tokens short-lived and rely on refresh tokens or re-authentication flows. When you decode a token, a very long exp window can be a sign that you should tighten lifetimes to reduce risk.

Validate both claims and signature

Decoding alone does not prove authenticity. For sensitive flows, ensure the signature verifies and then validate claims such as issuer, audience, and time constraints. The “Verify signature” mode helps you confirm keys and algorithms during development and troubleshooting.

Watch for algorithm mismatches

If your services expect RS256 but a token shows HS256 (or vice versa), that mismatch can cause failed authentication or, worse, misconfiguration risks. Always confirm the header’s alg and enforce an allowlist in your application.

FAQ

No. Decoding only reveals the header and payload contents. Verification checks whether the signature matches the header+payload using the correct algorithm and key.

For HS256/384/512, paste the shared HMAC secret used to sign the token. For RS256/384/512, paste the PEM-formatted RSA public key that matches the private key used to sign.

Some tokens are created without a signature for testing, but using “none” in production is typically unsafe. Your application should enforce an allowlist of algorithms and reject unsigned tokens where signatures are required.

Yes. Signature verification only confirms the token was signed with the right key. Expiration is a separate claim check; your application should reject tokens that are expired or not yet valid.

This tool focuses on signed JWTs (JWS). Encrypted JWTs (JWE) require decryption keys and a different processing flow. If you paste a JWE, the tool will treat it as a string and may not be able to decode meaningful JSON parts.

Why Choose This JWT Decoder?

When you’re troubleshooting authentication, clarity matters. This tool turns a JWT into a human-readable report, highlights time-based claims, and helps you confirm that the token structure matches what your backend expects.

Use it as a quick inspection layer in your workflow: decode first, verify if you have a key, then fix configuration issues with confidence. Paste, inspect, copy, and move on—without installing dependencies or juggling multiple tools.