JWT Decoder

About JWT Decoder

JSON Web Tokens (JWTs) are the standard for authentication and secure information exchange in modern API architecture, OAuth 2.0 authorization flows, OpenID Connect, and stateless session management. Understanding and troubleshooting these tokens is crucial for developers and security analysts. This free online JWT Decoder and Verifier goes far beyond basic Base64Url decoding. It enables you to instantly inspect headers, payloads, and claim values in a readable format, converts expiration (exp), issued-at (iat), and not-before (nbf) timestamps into your local timezone, and validates cryptographic signatures using your HMAC secret or RSA public key. Uniquely, this tool also functions as an interactive JWT generator: you can modify header or payload JSON claims and instantly re-encode and sign them using a secret or private key. Everything is processed 100% locally in your web browser—your tokens, private keys, and HMAC secrets never leave your device, ensuring maximum security and absolute data privacy.

How to Use JWT Decoder

1. Paste Your JWT: Copy the JWT string (the long dot-separated value from your Authorization header, cookie, or response body) and paste it into the input.
2. Verify or Sign the Token: Enter your HMAC secret or RSA Public/Private Key PEM to verify the signature, or edit the JSON claims and re-sign to generate a modified token.
3. Analyze Expiry and Claims: Check the claims explainer for key information and view the expiration status warning to see if the token is valid or expired.

Key Features

• Bi-directional Decode & Edit: Decode any token or edit the header/payload JSON to generate a new signed JWT in real-time.
• Cryptographic Signature Verification: Verify signatures with HS256/HS384/HS512 HMAC secrets or RS256/RS384/RS512 RSA Public Keys. Confirm token integrity instantly.
• Token Generator & Signer: Sign edited payloads using your HMAC secrets or RSA Private Keys directly in the browser using high-performance cryptographic primitives.
• Human-Readable Timestamps: Automatically parses standard claims like exp, iat, and nbf, translating Unix epoch timestamps to human-readable dates in your local timezone.
• Interactive Claims Explainer: Struggling to remember JWT specs? Inspect standard claims directly under the editor for clear explanations of iss, sub, aud, and others.
• 100% Local & Private Processing: No server-side API calls. Cryptographic operations run in-browser, guaranteeing that secrets and user tokens remain fully secure and private.

Benefits

• Streamline Authentication Debugging: Identify authentication failures immediately by checking for token expiration, incorrect audience parameters, or mismatched algorithms.
• Safe Mock Token Generation: Create valid mock tokens for testing frontend auth states or API gateways without needing to configure a complex OAuth server in development.
• Verify Key Integrity Offline: Verify signed payloads locally. Securely use public keys or development HMAC secrets without sending them to third-party endpoints.
• Clear Timezone Parsing: Stop converting epoch timestamps in your head. The decoder shows expiration relative to your local computer's timezone.
• Educational Claims Inspector: Ideal for developers learning OAuth2 and OpenID Connect to understand standard payload properties like iss, sub, aud, and jti.

Supported Formats & Capabilities

• JWT strings (paste as text — eyJ... format)
• Bearer tokens from Authorization headers

Common Problems & Solutions

My token says 'Invalid Signature'. Why?

A signature mismatch happens if the HMAC secret or RSA public key is incorrect, or if any character in the header/payload was modified. Make sure you enter the correct verification key.

Why does the tool show my token is expired?

The token's exp claim is a Unix timestamp in the past. Standard systems will reject this token. Check your token generation logic to extend the lifespan.

Can I verify RSA or ECDSA signatures?

Yes. The tool supports RSA algorithms (RS256, RS384, RS512) out-of-the-box. Ensure you paste a valid PEM-formatted public or private key.

Why is my secret/key safe with this tool?

The cryptographic verification and signing algorithms are executed entirely on your local machine using client-side JavaScript. No data is transmitted over the network.

Pro Tips & Best Practices

• When debugging API errors (like 401 Unauthorized), check both the exp (expiration) and aud (audience) claims. These are the two most common culprits for rejected tokens.
• Use the template presets (HS256 or RS256) to load example tokens and keys to see how header editing, verification, and signing behave.
• If your server uses a base64-encoded HMAC secret, remember to check the 'Secret is Base64' option so it is decoded correctly before verification.

Privacy & Data Security

JWT decoding, editing, and signature verification run entirely in your web browser using client-side JavaScript and node-forge. When you input a token, secret key, or PEM key, it is processed locally in your browser's memory. No token payloads, secrets, or keys are uploaded to any server, logged, or saved. This ensures complete confidentiality for enterprise tokens and development keys.

Frequently Asked Questions

Is it secure to paste my JWT and secrets here?

Yes, because this tool has no backend. All operations, including HMAC/RSA signature generation and verification, run locally on your device's browser. However, never share production secrets or tokens over public channels.

Can I edit and generate a new JWT with this tool?

Yes. You can edit the JSON strings in the Header and Payload sections, choose your signature algorithm, provide a secret or private key, and the tool will automatically encode and sign the new token in real-time.

What algorithms are supported for signing and verification?

We support HMAC algorithms (HS256, HS384, HS512) and RSA algorithms (RS256, RS384, RS512). The tool can decode any JWT, but signature validation is active for these suites.

What are standard JWT claims?

Standard claims are predefined keys in the payload like sub (subject/user ID), iss (issuer), aud (audience), exp (expiration), and iat (issued at). They help standardized systems process identity and session state.

What is the difference between a JWT and a signed JWT?

All JWTs contain a header and payload. A signed JWT (or JWS) includes a third section—a cryptographic signature—which ensures the payload has not been tampered with since issuance.

How does the timezone conversion work?

The tool reads the epoch timestamp from claims like exp and iat, multiplies them by 1000, and formats them using the browser's native locale timezone configuration, displaying local date and time.

Related Developer Utilities