JWT Decoder
Free online tool · runs in your browser
Inspect JWT tokens like jwt.io, in your browser.
Algorithm
Decode always works locally. Signature check is optional and never leaves this browser.
Quick tutorial
- 1Paste a JWT.
- 2Confirm the algorithm chips (HS256, RS256, ES256, PS256, none).
- 3Optional: paste an HMAC secret or PEM public key to verify the signature.
- 4Review header, payload, signature, and human-readable claims.
Free online jwt decoder
Decode JWT tokens online and inspect the header, payload, and expiration without sending the token anywhere. Choose HS256, RS256, ES256, PS256, or none, then optionally paste a secret or public key to check the signature locally. Treat decoded claims as untrusted until verification succeeds. Avoid production tokens on shared devices. Our guide on decoding JWTs without uploading explains decode vs verify in more detail.
Documentation last reviewed .
Decode vs verify
Decoding shows the header and payload claims. Verification checks that the signature matches a secret or public key you provide. Always treat decoded claims as untrusted until verification succeeds and your application enforces expiry, issuer, and audience.
ShadowReference supports common algorithms (HS*, RS*, ES*, PS*, none) with optional local verification via Web Crypto. Secrets and keys stay in the browser session and are never sent to our servers.
Safer JWT debugging
Prefer staging tokens when you only need structure. Avoid pasting production refresh tokens on shared devices. Read the Claims section for human-friendly timestamps when iat/exp are present. See our guide on decoding JWTs without uploading for a fuller walkthrough.
How to use JWT Decoder
- Paste a JWT.
- Confirm the algorithm chips (HS256, RS256, ES256, PS256, none).
- Optional: paste an HMAC secret or PEM public key to verify the signature.
- Review header, payload, signature, and human-readable claims.
Limitations
- Decoding is NOT verification. Treat claims as untrusted until the signature status is verified.
- RSA/ECDSA/PSS verification needs an SPKI public key (BEGIN PUBLIC KEY). Certificates are not imported.
Example
Input
header.payload.signature
Output
Decoded header and payload JSON
FAQ
Frequently Asked Questions
Does this JWT decoder verify signatures?
Decoding always works without a key. Optional verification runs in your browser for HMAC (HS256/384/512) and asymmetric algorithms when you paste a secret or SPKI public key.
Is it safe to paste a JWT here?
Processing is local, but avoid production tokens on shared or untrusted computers. JWTs can contain emails, user IDs, and other claims.
Can I decode an expired JWT?
Yes. Expiration is displayed when the exp claim exists; an expired token can still be decoded.
Is decoding the same as trusting the token?
No. Anyone can forge a payload. Only accept claims after signature verification and your app’s issuer, audience, and expiry checks.
What key format do I need for RS256?
Paste an SPKI public key (BEGIN PUBLIC KEY). Do not paste private keys or certificates into a public tool.
Is it safe to paste production JWTs?
Avoid pasting secrets on shared machines. Optional verification stays in the browser and still does not prove a token is safe to trust in your app.
Is JWT Decoder free to use?
Yes. JWT Decoder on ShadowReference is free, with no account, no watermarks, and no server-side processing.
Does this tool send my data to a server?
No. All processing happens locally in your browser. Your input never leaves your device.
Related guides
Deeper reading on private, browser-based workflows for jwt decoder and related tools.
- Decode JWT Tokens Without Uploading Them — Understand JWT header and payload claims, why decoding is not verification, and how to inspect tokens privately in the browser.
- Why Private Browser Developer Tools Matter — Why ShadowReference runs every tool in your browser, what “no upload” really means, and how that helps day-to-day engineering work.