Development
JWT Decoder
Paste a JWT to read the header and payload, including issuer, subject, audience, and expiry. The signature stays unchecked until you paste the HMAC secret or PEM public key that belongs to that token. Encrypted tokens show the header only. Nothing is stored.
Score
88%
Type
Utility
Core features
Header and payload
Decode the base64url parts into JSON and list the standard time claims.
Optional signature check
HS256, HS384, and HS512 use the shared secret you paste. RSA and ECDSA use a PEM public key.
Expiry
See whether exp or nbf says the token is current, expired, or not yet valid.
Specifications
| Algorithms | HS, RS, PS, and ES signatures |
|---|---|
| Encrypted tokens | Header only |
| Key | Optional, not stored |
| Privacy | Not stored |