What is this tool?
This JWT decoder reads JSON Web Tokens and shows the header and payload side by side with the colour-coded token. Developers use it to debug logins, check claims and see when a token expires. Paste a token and it decodes live. The payload shows as JSON or as a claims table with readable dates and explanations, and warnings flag alg none, expired or not-yet-valid tokens, a missing exp, weak HMAC secrets and keys embedded in the header. Verify signatures with a shared secret (text, Base64 or hex) for HS256, HS384 and HS512, or with a public key for RS, PS, ES and EdDSA tokens: paste a PEM public key, an X.509 certificate, a JWK, or a JWKS matched by kid. The Builder signs real tokens with a secret or private key and can generate a new secret or key pair. Everything runs in your browser with Web Crypto, so tokens and keys are never uploaded.
How to Use
- Paste your token into Encoded token. It decodes as you type, or press Example to try one.
- Read the Header and Payload. Switch Payload to Claims for readable dates and claim explanations, and check any warnings above them.
- To verify the signature, enter the secret for HS tokens, or paste the public key, certificate, JWK or JWKS for RS, PS, ES and EdDSA tokens.
- To make a token, open Builder / signer, pick the algorithm, edit the payload JSON, enter or generate a key, and press Sign JWT.
- Press Open in decoder to check the new token, or Edit and re-sign in Builder to change an existing one.
Frequently Asked Questions
Is my token sent to a server?
No. The token is Base64URL-decoded in your browser, and signature checks use the browser's Web Crypto API. Neither the token nor the secret leaves the page.
Does decoding a JWT prove it is valid?
No. Anyone can decode the header and payload because they are only Base64URL encoded. Only a signature check with the correct key proves the token was not altered.
Can it verify RS256 or ES256 tokens?
Yes. RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA (Ed25519) are verified with Web Crypto. Paste a PEM public key, an X.509 certificate, a JWK, or a JWKS; with a JWKS the key is picked by the token's kid.
Does the Builder make real signed tokens?
Yes. HS tokens are signed with your secret, and RS, PS, ES and EdDSA tokens with a private key in PEM or JWK form. Generate key pair creates a fresh key in your browser. alg none produces an unsigned token with an empty signature.
Other tools
There are more calculators, converters and editors on Wivrix. If something is missing, tell us.