Skip to content
JSONDiff.in

JWT Decoder

Decode tokens, inspect claims and verify signatures

Decoded locally. Tokens never leave your browser.

Encoded token

headerpayloadsignature

Verify signature

Decode a token to verify its signature.

Header

Payload

Claims

Claims from the payload appear here with readable dates.

How to use

  1. Paste a JWT, with or without the "Bearer" prefix.
  2. Read the decoded header, payload and claims. Time claims show readable dates and whether the token is expired.
  3. For HS256/384/512 tokens, enter the secret to verify the signature.

Debugging JWTs safely

The JWT decoder splits the token into its three parts, decodes the Base64URL header and payload and presents every claim with its meaning. Because decoding happens locally, you can inspect production tokens without sending them to a third party. Remember that anyone holding a token can read its payload, so never put secrets in claims.

Frequently asked questions

A JSON Web Token is a compact, URL-safe string with three Base64URL parts: a header (algorithm and type), a payload (claims such as user id and expiry) and a signature that proves the token was issued by someone holding the key.