Skip to content
MtrXTools

JWT decoder

Decode a JWT's header and claims, see when it expires, spot risky settings such as alg none, and verify the signature with a secret or public key (HS, RS, PS, ES and EdDSA). Runs in your browser; the token isn't sent anywhere.

What it shows

  • The header: algorithm, token type and key ID.
  • Every claim, with registered ones named (issuer, subject, audience, scopes, tenant) and times shown as dates: when it was issued, when it becomes valid and when it expires.
  • Warnings for risky tokens: alg none, a key or key URL inside the header, no expiry, a long lifetime or an issue time in the future.
  • Signature verification with a shared secret (HS256, HS384, HS512) or a public key as PEM, a certificate, a JWK or a JWKS matched by kid (RS, PS, ES and EdDSA).

Decoding and verification run in your browser with WebCrypto. The token isn't sent anywhere, isn't put in the address bar and isn't saved in recent runs.

Decoding isn't verifying

Anyone can read a JWT: the header and payload are only base64url-encoded, not encrypted. What makes a token trustworthy is the signature, checked with the issuer's key, plus the issuer, audience and expiry. A server that decodes without verifying will accept forged tokens.

Questions

Is it safe to paste a production token here?
The page never sends it anywhere, but a valid access token is a password until it expires. Prefer expired tokens or test tokens, and never paste private keys.
Why does verification fail with the right key?
Check that the key matches the algorithm (an RSA key for RS256, a P-256 key for ES256), that a JWKS has the key with the token's kid, and for HS tokens whether the secret is base64-encoded.
What is an encrypted JWT?
A JWE has five parts instead of three. Only its header is readable; the claims need the recipient's private key.

Related tools