JWT Decoder and Debugger
Decode JWT header and payload. Verify HS256 and RS256 signatures in the browser.
🔒 Client · OfflineGive the shared secret for HS256, HS384, and HS512. Give a PEM or a JWK public key for RS256, RS384, and RS512.
About JWT debugging
The tool parses Base64URL header and payload data and formats them as JSON.
Expiration uses the exp claim. Signature checks use Web Crypto. HS256, HS384, and HS512 need the shared secret. RS256, RS384, and RS512 need the public key in PEM or JWK form.
The tool does not download a public key. Paste the key that you want to use.
Give an expected issuer or an expected audience to check the iss and aud claims. An empty field is not checked. The aud claim can hold one value or a list, and a match on one entry of the list counts as a match.
Each check has its own card. The signature, the time claims, the issuer, and the audience pass or fail on their own. A card shows "Not checked" when the tool has no data for that check.
The iat, nbf, and exp claims hold Unix seconds. The tool shows each one as an ISO date and as a relative time. The relative time updates every second.
An alg of none gets an urgent warning. Such a token has no signature, so the signature check fails.
"Load Sample" fills the tool with a demo token, a demo secret, and the demo issuer and audience. The sample data is fake. Do not use the demo secret for a real token.