JWT Decoder & Debugger
Paste a JSON Web Token to decode its header, payload, and verify its signature. All processing is client-side — your tokens never leave your browser.
Security: All decoding happens in your browser. Your JWT is never sent to any server. For HMAC verification, enter the shared secret. For RSA, paste the public key in PEM format. The signature is verified using the browser's built-in Web Crypto API.
How to Use
Decode: Paste any JWT access token, ID token, or refresh token into the input field. The tool automatically splits it into the three parts (header.payload.signature), Base64-decodes each section, and displays the JSON.
Verify HS256/HS384/HS512: Enter the shared secret (the same key used to sign the token). The tool computes the expected HMAC and compares it to the token's signature.
Verify RS256/RS384/RS512: Paste the RSA public key in PEM format (-----BEGIN PUBLIC KEY-----). The tool verifies the signature using Web Crypto API.
Claims: Standard claims (iss, sub, aud, exp, iat, nbf, jti) are extracted into a table. Expired tokens (exp in the past) are highlighted in red.
Example Use Cases
- Debug OAuth/OIDC flows — Decode ID tokens and access tokens during authentication integration
- Verify token expiration — Check if users are getting 401 errors due to expired tokens
- Inspect claims — Confirm custom claims (roles, permissions, tenant IDs) are being set correctly
- Validate signatures in development — Quick sanity check before deploying auth changes