Decode and verify JSON Web Tokens instantly and securely.
Paste your full JWT into the 'Encoded Token' field. The header and payload will be decoded instantly.
To verify the signature, paste your secret or PEM-encoded public key into the second field.
The tool will immediately attempt to verify the signature and display whether it's valid, invalid, or expired.
A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The claims are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure, enabling the claims to be digitally signed or integrity protected. It consists of three parts separated by dots: Header, Payload, and Signature.
Yes, absolutely. This tool is 100% client-side. All decoding and verification happen in your browser using JavaScript. Your token and secret key are never sent to our servers, ensuring your sensitive data remains completely private and secure on your own computer.