Skip to content
utilnest

JWT decoder and signature verifier

Read the header and claims of any JSON Web Token, check its expiry and verify its signature.

  • Works in your browser
  • No sign-up
  • Free to use

How to use JWT decoder

  1. 1

    Paste the token into the "Encoded token" box. A "Bearer " prefix, quotes and line breaks are removed for you.

  2. 2

    Read the decoded header and payload, and the table of standard claims with their dates in your time zone.

  3. 3

    Check the badge that says whether the token is valid now, expired or not valid yet.

  4. 4

    To verify the signature, enter the shared secret (HS256/384/512) or paste the public key, certificate, JWK or JWKS (RS, PS, ES and EdDSA).

What this tool does

A JSON Web Token has three base64url-encoded parts: a header, a payload of claims, and a signature. The decoder turns the first two back into readable JSON as soon as you paste a token. It lists the registered claims from RFC 7519 (iss, sub, aud, exp, nbf, iat and jti) with plain-language names, and converts the timestamps into dates in your own time zone, such as "Expires in 3 hours".

Decoding only shows what a token says. Verifying it proves who signed it, so the tool can also check the signature with the secret or public key you provide.

Features

  • Instant decoding of header and payload, including UTF-8 text and payloads that aren't JSON.
  • Expiry status relative to now: valid, expired, not valid yet, or no expiry. Also flags an issued-at time in the future.
  • Signature verification for HMAC, RSA PKCS#1 v1.5, RSA-PSS, ECDSA and Ed25519 tokens, using your browser's Web Crypto.
  • Flexible keys: PEM public keys, RSA public keys, X.509 certificates, JWK and JWKS. If you paste a private JWK by mistake, only its public part is used and you're warned.
  • Clear errors for a wrong number of parts, broken base64url, invalid JSON, a key that doesn't fit the algorithm, and unsigned (alg "none") tokens.
  • Copy buttons for the decoded header and payload.

Limits

  • Encrypted tokens (JWE) and JWS JSON serialization aren't supported; only the compact header.payload.signature form is.
  • PEM private keys aren't accepted for verification. Paste the public key instead.
  • The validity badge checks time claims only. It doesn't check iss or aud against what your application expects.
  • EdDSA verification needs a browser with Ed25519 in Web Crypto (current Chrome, Edge, Firefox and Safari have it).

Where your text is processed

This tool works in your browser: what you type or paste is processed on your own device, so it isn't sent to our server for this tool. Some other tools on UtiloNest do use our server, and their pages say so.

Frequently asked questions

Is it safe to paste a real token here?

The token, the secret and the key are processed by JavaScript in this tab, using your browser's built-in Web Crypto, so they aren't sent to our server. A live token still grants access to whatever it protects, so treat it like a password wherever else you paste it.

Does decoding a JWT mean it is valid?

No. Anyone can read a JWT's header and payload, because they're only base64url-encoded, not encrypted. A token is trustworthy only when its signature checks out with the issuer's key and its time claims (exp, nbf) say it's current. This tool shows both, but your server must check them too.

Which algorithms can it verify?

HS256, HS384 and HS512 with a shared secret; RS256, RS384 and RS512 and PS256, PS384 and PS512 with an RSA public key; ES256, ES384 and ES512 with an EC public key; and EdDSA with an Ed25519 key, in browsers that support Ed25519 in Web Crypto. Tokens with alg "none" are unsigned, so there's nothing to verify.

What key formats are accepted?

A PEM public key (BEGIN PUBLIC KEY), a PKCS#1 RSA key (BEGIN RSA PUBLIC KEY), an X.509 certificate (BEGIN CERTIFICATE), a single JWK, or a JWKS with a "keys" array. With a JWKS, the key whose kid matches the token header is used. HMAC secrets can be typed as text or given as base64.

Why does it say "Expired" when my app still accepts the token?

The status uses this device's clock and RFC 7519's rules, where a token is expired from its exp time onwards. Many servers allow a little clock skew, often a minute or more. If your computer's clock is wrong, the status will be wrong too.

Can it decode encrypted tokens (JWE)?

No. A JWE has five parts and its payload is encrypted, so it can't be read without the recipient's private key. The tool recognises a JWE and says so instead of showing garbled data.

Was this tool helpful?