JWT Decoder & Verifier
Paste a JSON Web Token to read its header and claims, see when it expires, spot common security mistakes and check the signature with a secret or public key. Everything happens in your browser: tokens and keys are never sent to us.
- Runs in your browser
- HS, RS, PS, ES and EdDSA
- Claims explained
A token works like a password until it expires. This page never sends it anywhere, but it's good practice not to paste live production tokens into websites, and to clear it when you're done.
Check the signature
What a JWT is
- Three Base64url parts joined by dots: a header (which algorithm signed it), a payload of claims (who the user is, what they can do, when it expires) and a signature.
- The payload is only encoded, not encrypted. Anyone with the token can read it, so it must never hold passwords or personal data that isn't needed.
- The signature proves the token came from whoever holds the key and hasn't been changed. Microsoft Entra ID, Google, Auth0 and most APIs use them.
What a server must check
- The signature, with an algorithm it chose itself. Never accept "none", and never let the token's header pick the key.
- exp and nbf (allowing a minute or two for clock differences), iss (the issuer you expect) and aud (your own app).
- HS256 secrets must be at least 256 bits of random data. Short secrets can be cracked offline from a single token. Our Key & Secret Generator makes proper ones.