JSON-prettify

    JWT Decoder & Verifier

    Decode JSON Web Tokens and check their signature, right in your browser.

    Encoded token

    How to decode a JWT

    1. Paste a JWT. A "Bearer " prefix is removed automatically.
    2. Read the decoded header and payload, and check when the token was issued and when it expires.
    3. To verify the signature, paste the secret or public key used to sign it.

    Frequently asked questions

    Is it safe to paste a token here?

    Decoding and verification run entirely in your browser; the token, secret and key are never sent anywhere or saved. As with any credential, avoid pasting live production tokens on shared computers.

    Which algorithms can be verified?

    HMAC (HS256, HS384, HS512) with a shared secret, and RSA (RS256–RS512, PS256–PS512), ECDSA (ES256, ES384, ES512) and EdDSA with a public key.

    Which key formats are supported?

    PEM public keys and certificates, a single JWK, or a JWKS, where the key is picked by the token's kid.

    Does decoding prove a token is genuine?

    No. Anyone can read a JWT's contents. Only a successful signature check shows it was issued by the holder of the key.

    Why can't my token be decoded?

    Encrypted tokens (JWE, five parts separated by dots) can't be read without the decryption key, and anything that isn't three base64url parts separated by dots isn't a valid JWT.