Free tool
JWT Decoder That Explains Every Claim and Checks Signatures
Paste a token and the three parts appear in colour, with the header and payload as tidy JSON and each claim explained in a table. Add a key if you also want to know whether the signature is genuine.
Check the signature
Decoding needs no key. To check that the token is genuine, give the key it was signed with. Algorithm: none yet.
HS256 to HS512, RS, PS and ES (256 to 512) and EdDSA. Keys as PEM, a certificate, a JWK or a JWKS (picked by kid).
Tokens and keys are decoded and checked in your browser with its built-in cryptography, and they are never sent or saved. Only your choice of time zone display is remembered.
When a login fails and you need to see the token
A user is signed out too early, an API answers with a refusal, or a new identity provider returns something unexpected. The first useful step is to look inside the token. Paste it into the Token box and it is split into header, payload and signature, each coloured so you can see where one ends.
The Header and Payload panels show formatted JSON with a Copy button. Below them a table lists every claim with a plain name and a short meaning, for example Issuer, Subject, Audience, Expires, Not before and Issued at.
Reading the time claims
The claims exp, iat, nbf and auth_time are stored as numbers, which are hard to read. The tool writes them as dates, either in your own time zone or in UTC, and adds how long ago or how soon each one is. Use the Show times switch to change between the two.
It also raises a flag when the token has already expired or is not valid yet. Many puzzling sign-in errors turn out to be a clock that is a few minutes out on a server, so the comparison with the current time is worth a look.
Decoding is not the same as verifying
Anyone who holds a token can read it. The tool proves this by decoding without asking for any key. What a key adds is proof that the token was signed by the party you trust and has not been changed.
| Key you supply | Used for |
|---|---|
| A secret, as text or Base64 | Signatures made with a shared secret, HS256 to HS512 |
| A public key as PEM, or a certificate | RS, PS and ES algorithms from 256 to 512, and EdDSA |
| A JWK | One public key written as JSON |
| A JWKS | A set of keys, where the right one is picked by its kid |
Tick The secret is Base64 encoded when your secret was stored in that form. The line beside the key box says which algorithm the token uses and whether the check has passed.
Handling real tokens sensibly
- A live token may still work as a password until it expires, so avoid pasting one into any page you do not trust.
- Here nothing leaves the browser, but a shared screen or a screenshot can still leak a token.
- Do not treat the payload as secret. Put no private data in it that the holder should not see.
- An encrypted token, called a JWE, is recognised but its contents stay hidden without the matching key.
A decoder is a debugging aid. Real checks of signature, issuer, audience and expiry belong on your server.
A short checklist when a token is refused
- Look at Expires and Not before first, and compare them with the current time.
- Check Audience, since a token made for one service is often refused by another.
- Check Issuer against the address your server expects.
- Read the algorithm in the header and confirm that your server accepts it.
- Give the tool the key and see whether the signature passes.
A failing signature with a correct key usually means the wrong key was picked from a set, so check the kid value in the header against the keys you hold.
Where a site owner meets tokens
Members areas, single sign-on, headless storefronts and paid content gates all lean on tokens somewhere. If you are connecting a site to another service, our Webflow integration page explains how we approach those connections.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact string with three parts joined by dots: a header, a payload of claims and a signature. Services use it to pass identity or permission information.
Can this tool tell me if a token is genuine?
Only if you give it the right key. Without one it decodes the token and says the signature has not been checked.
Why does it say my token has expired?
The exp claim holds a time, and the tool compares it with your device clock. If your clock is wrong the message will be wrong too.
Which algorithms can it verify?
HS256 to HS512, RS, PS and ES at 256 to 512 bits, and EdDSA. Keys can be PEM, a certificate, a JWK or a JWKS.
Is it safe to paste a production token?
The page does not send or store it. Still, a live token can grant access, so use a test token when you can.
Why can I read the payload without a key?
The payload is only encoded, not hidden. The key protects against tampering, not against reading.
More free tools
- Base64 decoder and encoder: Decode Base64 to text or a file and encode text or files to Base64 and data URLs.
- Unix timestamp converter: Convert Unix timestamps to dates and dates to timestamps in any time zone, one or in bulk.
- JSON formatter: Format, minify, validate and repair JSON, browse it as a tree, or convert it to YAML or CSV.
- URL encoder and decoder: Percent-encode or decode a URL or a query value, with options for strict encoding and plus signs.
- UUID generator: Make v4, v7 or nil UUIDs in bulk and check whether a UUID is valid.