gratistools.be
Sign in

JWT Decoder

Paste a JSON Web Token to read its claims. Optionally verify the signature with a secret or public key.

Header


    
Payload

  

  
Claims

  
Verify signature

    
    
    
 

    
Use a public key (PEM or JWK/JWKS) for RS, PS, ES and EdDSA tokens. Never paste private keys or production secrets into any website — including this one, although nothing here is sent anywhere.

  

  
Decoded and verified on your device. The token is never uploaded.



  




  


What a JWT contains


A JSON Web Token is three Base64URL-encoded parts separated by dots: a header (the signing algorithm and key ID), a payload
of claims (who the token is for, when it expires, what it allows) and a signature. The header and payload are only encoded, not encrypted —
anyone holding the token can read them, which is exactly what this page does. Don't put secrets in a JWT payload.


Timestamps such as exp (expiry), iat (issued at) and nbf (not before) are shown in your local time with how long ago or
how far ahead they are, and the status tells you at a glance whether the token has expired.



Decoding is not verifying


Reading a token proves nothing about who issued it: anyone can create a token with any payload. Only a valid signature shows it was issued by
someone holding the key. To check one here:


    
  
  • HS256/384/512 — enter the shared secret (tick Base64-encoded if your secret is stored that way, as with some Auth0 and Azure setups).
    • 
  
  • RS, PS, ES and EdDSA — paste the issuer's public key as PEM (-----BEGIN PUBLIC KEY-----), a JWK, or a whole JWKS document; the key
  matching the token's kid is picked automatically. Identity providers publish their keys at a JWKS URL, usually listed in
  /.well-known/openid-configuration.
    • 



A server must also check exp, nbf, iss and aud and reject alg: none; a correct signature alone isn't enough.



Is my data uploaded?


No. Decoding and verification run in your browser, so nothing you add is sent to gratistools.be. See the privacy page for details.