Paste the token
Paste a JWT, with or without “Bearer”. The header and payload are decoded straight away.
Free JWT Decoder
Paste a token to see its header and claims, with expiry and issue times as real dates. Check the signature with a secret or public key, or sign a new token for testing.
Open JWT Decoder →How to decode a JWT
Read the claims
See who issued it, for whom, and when it expires, as dates in your time zone with “in 2 hours” or “3 days ago”.
Verify the signature
Enter the secret or paste the public key, certificate or JWKS to check the token wasn’t changed.
Manlin services
Make space for what matters
Use Manlin to reflect, plan and take your next step.
JWT Decoder FAQ
Is it safe to paste a real token here?
The token, secret and keys are processed in your browser with its built-in cryptography and are never sent anywhere. Even so, a live token works like a password until it expires, so prefer test tokens and never share one in chats or tickets.
Which algorithms can it verify?
HS256, HS384 and HS512 with a shared secret; RS256/384/512 and PS256/384/512 with an RSA public key; ES256, ES384 and ES512 with an EC public key; and EdDSA (Ed25519) in browsers that support it. Keys can be a PEM public key, an X.509 certificate, a JWK or a JWKS (picked by the token’s kid).
Does decoding prove a token is genuine?
No. Anyone can read a JWT, because the header and payload are only encoded, not encrypted. Only a valid signature shows it was issued by the key holder and not changed.
What is alg “none”?
An unsigned token. Servers must never accept it, and this tool never reports it as verified.
Why does my expiry show a date far in the future?
exp, iat and nbf must be seconds since 1970. A value in milliseconds is 1,000 times too large; the decoder warns when it sees one.
Can I create tokens?
Yes. Switch to Encode, edit the header and payload, and sign with a secret (HS256/384/512) or a private key in PEM or JWK form. Quick buttons set iat and exp.
Are encrypted tokens (JWE) supported?
No. A JWE has five parts and needs the recipient’s private key to read; this tool decodes and verifies signed tokens (JWS).
More tools in this category
Base64 Encoder & DecoderEncode text or any file to Base64 and decode it back. URL-safe Base64, data URIs, image preview, hex view and character sets. Runs in your browser.
JSON FormatterFormat, validate and minify JSON free. Pinpoints errors by line and column, sorts keys, shows a collapsible tree with copyable paths, and keeps big numbers exact. Runs in your browser.
Regex TesterTest JavaScript regular expressions free: live match highlighting, capture and named groups, replace and extract preview, a plain-words explanation, a cheat sheet and ready-made patterns.