About this tool
Decode and inspect JSON Web Tokens (JWT) safely in your browser. View header parameters, payload claims, expiration timestamps, and optionally verify RSA signatures locally.
JWT Decoder
Decode JWT headers and claims locally with expiration status and optional RSA public-key signature verification.
Example
- token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZGVtbyIsImlhdCI6MTcwMDAwMDAwMH0.signature
Output
DEVWaiting
Run the tool to generate output.
When to use this tool
Use JWT Decoder during backend API development, authentication troubleshooting, and single sign-on (SSO) debugging to inspect token claims safely.
Inputs, Formats & Specifications
- Accepted Inputs
- Encoded JWT string (`header.payload.signature`), optional RSA public key (PEM / SPKI)
- Output Formats
- Decoded JSON Header, Decoded JSON Payload, human-readable expiration dates, signature validity status
- Supported Standards
- JWT (RFC 7519), JWS (RFC 7515); RS256, HS256, ES256 claims decoding; RS256 signature verification
- Browser Limits & Scope
- Decoding claims does not guarantee the token has not been tampered with unless signature verification is performed with the authentic public key.
How to use this tool
- Paste an encoded JSON Web Token (`eyJh...`) into the token input field.
- Inspect the Decoded Header card displaying the signing algorithm (e.g. RS256, HS256) and token type.
- Inspect the Decoded Payload card showing all claims: Issuer (`iss`), Subject (`sub`), Expiration (`exp`), Issued At (`iat`), and custom claims.
- Check human-readable timestamps indicating whether the token is currently active or expired.
- Optionally paste a public key (PEM / SPKI) to cryptographically verify the token's RSA signature locally.
Examples
Auth0 / Firebase Token Expiration Audit
Decode an OAuth2 / OIDC access token to inspect user permissions (`scope`), tenant identifiers, and check whether the token has expired.
Local Signature Verification
Paste an RSA public key certificate to mathematically verify that a token was genuinely signed by your identity provider without exposing secret keys.