Skip to content
Tipamedia

Developer & Security

JWT Decoder and Verifier

Paste a token to see what is inside and whether it has expired. Enter a secret or public key if you want to confirm the signature is genuine. Everything runs locally.

Free · no sign-up · runs in your browser · updated

Use JWT Decoder

The token is decoded in your browser and is not sent to any server. Even so, avoid pasting live production tokens on a shared computer.

The “Bearer ” prefix and quotation marks are removed automatically.

Paste a JWT to see its header, payload and time status.

How to use JWT Decoder

  1. Paste the JWT (the Bearer prefix can be included).

  2. Read the header, payload, time claims and security warnings.

  3. Optional: enter a secret (HS256/384/512) or a PEM/JWK public key (RS, PS, ES) to verify the signature.

Decoding is not verifying

A JWT’s header and payload are only base64url-encoded, not encrypted, so anyone holding the token can read them; never put secret data in the payload. What guarantees authenticity is the signature: the server must verify it with the correct key and reject the none algorithm. The valid or expired status in this tool is based only on the time claims, and is not proof that the token is genuine.

The time claims iat (issued at), nbf (not before) and exp (expiry) are Unix seconds; this tool shows them in WIB (UTC+7) and UTC, plus relative time. Values in milliseconds are flagged because JWT uses seconds.

Signature verification

HS256/384/512 use one shared secret. RS256/384/512 (RSA PKCS#1), PS256/384/512 (RSA-PSS) and ES256/384/512 (ECDSA) use a key pair; enter the public key as a PEM “BEGIN PUBLIC KEY” block or a JWK. Verification uses the browser’s built-in Web Crypto and sends nothing. An encrypted token (JWE, five parts) can’t be decoded without the decryption key, and EdDSA is not supported yet.

Be careful with live production tokens: even though they are processed locally, pasting them on a shared computer or capturing them in a screenshot is still risky. Rotate or revoke a token if it has been exposed.

Questions about JWT Decoder

Is it safe to paste a JWT here?

The token is processed in your browser and is not sent to a server. Even so, avoid live production tokens on shared devices and don’t share them.

Is a JWT encrypted?

An ordinary JWT (JWS) is only signed, not encrypted: anyone can read its contents. Only a JWE is encrypted, and it can’t be decoded here.

What do exp, iat and nbf mean?

exp is the expiry time, iat the time of issue, and nbf the time it becomes valid, all in seconds since January 1, 1970 UTC.

Why does verification say the signature is invalid?

The key or secret is wrong, the token has been altered, or the key doesn’t match the algorithm (for example an RSA public key for an HS256 token). For HS, the secret is read as plain UTF-8 text.

Other tools you may find useful

All Developer & Security tools

Need more than tools?

We build websites, apps, and custom systems for your business.

These tools are only a small part of what Tipamedia can build. Tell us what you need and we will help you work out the next step.

Discuss on WhatsAppSee our services