AnyTool
Your files never leave your device. All processing happens locally in your browser.

How do I decode a JWT token?

Paste a JSON Web Token into AnyTool's JWT Decoder to see the header, payload, and signature with claim explanations and a live expiry status. You can also verify the signature with a key. All decoding and crypto run in your browser — tokens never leave your device.

  • Decode header, payload, and signature with syntax highlighting
  • Verify HS/RS/PS/ES/EdDSA signatures with a secret, PEM, JWK, or JWKS
  • Human-readable claims and a live expiry countdown
  • 100% in your browser — tokens never leave your device, free

What is

JWT Decoding

JWT decoding splits a JSON Web Token into its base64url-encoded header, payload, and signature and renders them as readable JSON. Verification additionally checks the signature against a key to confirm the token is authentic and untampered.

Developer Tools

Related terms

JSON Web TokenSignature VerificationClaimsJWKS

How to Decode a JWT

Decode and verify a JSON Web Token entirely in your browser.

15 secWeb browser
  1. 1

    Paste the token

    Drop your JWT in; the header, payload, and signature decode instantly.

  2. 2

    Review claims

    Read the human-readable claims and live expiry status.

  3. 3

    Verify (optional)

    Add a secret, public key, JWK, or JWKS to verify the signature.

Result: A decoded and optionally verified JWT

Frequently Asked Questions

Yes — tokens are decoded and verified entirely in your browser and are never sent to a server.

All decoding and signature verification use the Web Crypto API in-page, so your token and keys never leave your device. There is no signup or vendor lead-gen funnel — unlike many JWT tools that load marketing scripts.

Yes — it verifies HS256/384/512, RS, PS, ES, and EdDSA signatures.

Provide a shared secret, PEM public key, JWK, or pasted JWKS and the tool verifies the signature and shows a valid/invalid/tampered badge — going beyond the decode-only or HS256-only tools.

Yes — it renders exp, nbf, and iat in UTC and local time with a live expiry countdown.

Standard claims are explained in plain English, and a live ticker shows whether the token is valid or expired, re-coloring the moment it crosses its expiry time.

Detailed Explanation

Methodology

How JWT Decoding and Verification Work

AnyTool decodes a JSON Web Token by base64url-decoding its three segments (header, payload, signature) and rendering them as syntax-highlighted JSON, using TextDecoder for correct UTF-8. Signature verification uses the Web Crypto API via the jose library, supporting HS256/384/512, RS, PS, ES, and EdDSA with a shared secret, PEM key, JWK, or pasted JWKS. Standard claims (iss, sub, aud, exp, nbf, iat) are explained in plain English with a live expiry countdown. All crypto runs in-page, so tokens and keys never leave the device.

  • base64url decode of header, payload, and signature
  • Verify HS/RS/PS/ES/EdDSA via Web Crypto (jose)
  • Local JWKS paste keeps verification fully offline
  • Claim explanations and live expiry ticker
  • Security lints: alg:none and algorithm-confusion warnings
Privacy & Security

Privacy-First, No Vendor Funnel

Unlike vendor JWT tools that load marketing scripts or push signups, AnyTool decodes and verifies entirely client-side with no analytics on the token. The only operation that can leave the device is fetching a remote JWKS URL, which is gated behind an explicit user action and clearly labeled; pasting a JWKS keeps everything offline.