JWT Decoder
Decode and verify JSON Web Tokens.
Paste a token to see header/payload JSON, expiration details, and signature validity. We never store or transmit your data.
JWT input
Tip: signature checks only work for HMAC-based tokens. For RSA/ECDSA, use your key
material and validation tooling.
Diagnostics
Waiting for tokenHeader
--
Payload
--
Signature
--
Timestamps
--
Issues
- Waiting for token input.
JWT decoding tips
Signature mismatch
Use the exact secret, algorithm, and token string. Any whitespace changes the HMAC.
Expired tokens
Check exp/nbf/iat values and compare to the issuer clock for drift.
Algorithm confusion
Ensure the header alg matches your verifier selection and your auth provider settings.