Free Online JWT Decoder & Verifier

How to Use

1. Paste your JWT into the "Encoded JWT" text area.
2. The header and payload will be decoded and displayed automatically.
3. Timestamp claims like `exp`, `iat`, and `nbf` will be shown in a human-readable format.

How to Verify a Signature

1. Select the correct algorithm from the dropdown menu.
2. Paste the secret (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms) into the "Secret / Public Key" text area.
3. Click the "Verify" button.
4. The verification result will be displayed above the decoded token.

Supported Key Formats

• HMAC (HS256, HS384, HS512): A plain text secret.
• RSA/ECDSA (RS/ES algorithms): A public key in PEM format (starting with `-----BEGIN PUBLIC KEY-----`) or a key in JWK format (a JSON object).

Common Claims

• exp (Expiration Time): The time after which the JWT is no longer valid.
• iat (Issued At): The time at which the JWT was issued.
• nbf (Not Before): The time before which the JWT is not yet valid.
• sub (Subject): The subject of the token.
• iss (Issuer): The issuer of the token.
• aud (Audience): The recipient that the token is intended for.