Skip to main content
ZeyroVault Tools

JWT Decoder Online

Decode JWT tokens and optionally verify HS256/384/512 or RS/ES signatures in your browser. Nothing is uploaded.

This decodes a JWT's header and payload and can verify a signature locally: HS* with the shared secret, RS*/ES* with a public JWK/JWKS. Verification is optional; a valid signature proves integrity, not that the issuer is trustworthy.

Tool workspace

Decode JWT Token

No result yet

Enter your input above and the result will appear here.

Parse JWK / JWKS

Paste a JSON Web Key (JWK) or a JSON Web Key Set (JWKS) to inspect its structure.

How It Works
Read the details +

What is JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed using a secret (with the HMAC algorithm) or a public/private key pair (using RSA or ECDSA).

JWTs are commonly used for authentication and information exchange in modern web applications. When a user logs in, the server generates a JWT containing the user's identity and permissions. The client then includes this token in subsequent requests, allowing the server to verify the user's identity without maintaining session state.

The key advantage of JWT is its stateless nature—the server does not need to store session information in a database. All necessary information is contained within the token itself, making JWT ideal for distributed systems and microservices architectures.

JWT Structure

A JWT consists of three parts separated by dots ("."): Header, Payload, and Signature. Each part is Base64Url encoded.

1Header

Contains metadata about the token, including the signing algorithm (alg) and token type (typ).

{
  "alg": "HS256",
  "typ": "JWT"
}

2Payload

Contains the claims—statements about the user and additional data. Claims are categorized as registered (standard), public, or private.

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622
}

3Signature

Ensures the token has not been tampered with. Created by signing the encoded header and payload with a secret key.

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

Standard JWT Claims

iss

Issuer - Identifies the principal that issued the JWT

sub

Subject - Identifies the principal that is the subject of the JWT

aud

Audience - Identifies the recipients that the JWT is intended for

exp

Expiration Time - The time on or after which the JWT must not be accepted

nbf

Not Before - The time before which the JWT must not be accepted

iat

Issued At - The time at which the JWT was issued

jti

JWT ID - Unique identifier for the JWT

References

How to Decode a JWT Token Online

Safely decode JWT header and payload in your browser without sending data to any server.

  1. 1

    Paste your JWT token

    Enter a complete JWT (e.g., xxx.yyy.zzz) into the input box.

  2. 2

    Click "Decode"

    The tool parses the token using Base64Url decoding.

  3. 3

    View claims

    Inspect header (alg, typ) and payload (iss, exp, sub, etc.) in readable JSON with human-readable timestamps.

When to Use This Tool
  • 1Debug authentication issues by inspecting JWT token contents
  • 2Verify token expiration dates and issued-at timestamps
  • 3Inspect custom claims and permissions embedded in tokens
  • 4Parse JWK/JWKS for key management and verification setup
  • 5Understand token structure during development and testing
  • 6Validate token structure and format during API integration
Security Tips
  • This tool only decodes JWTs—it does NOT verify signatures
  • Don't trust a JWT without proper signature verification on your server
  • Always use HTTPS when transmitting JWTs to prevent interception
  • Validate all claims (iss, aud, exp) before accepting a JWT
  • Store JWTs securely in httpOnly cookies or secure storage, not localStorage
  • Rotate signing keys regularly and implement key management best practices

Frequently Asked Questions

Is my token sent to a server?

No. The JWT is decoded in your browser only. The header and payload are displayed locally and nothing is transmitted.

Can I validate JWKS key sets?

Yes. Paste a JWKS key set to parse and validate its structure locally, without sending the token or keys anywhere.

What should I never do with a JWT?

Never paste a token into an online service you do not trust — tokens contain claims that may be sensitive. A client-side decoder keeps them on your machine.

Does the decoder verify the signature?

Yes, once you supply the key material. HS256/384/512 tokens are verified with a secret, and RS or ES tokens with a PEM public key or a pasted JWKS. Verification answers one question only — whether the signature matches. Expiry, issuer, and audience are reported separately, because a valid signature alone does not make a token trustworthy.

What is clock skew and how does it affect expiry checks?

Clock skew is the tolerated difference between your machine and the token issuer. A token is reported as expired only when `exp` is older than the current time plus the configured tolerance (30 seconds by default), and the same tolerance applies to `nbf` and `iat`. A short window of 30–60 seconds avoids false alarms from small clock drift.

Related Guides

Decode a token from logsHandle clock skewDecode a JWT in CIVerify a JWT signature
Network-verified: see this tool's measured requests
Your inputs remain on your device.

You are responsible for key management and output validation.