JWT Decoder
Decode and inspect JWT tokens
About this tool
The ToolNinja JWT Decoder is a free online JSON Web Token decoder. Paste any JWT and instantly see the decoded header, payload, and signature in color-coded sections — purple for header, blue for payload, red for signature. Use it to decode JWT tokens when debugging authentication issues, inspect JWT claims like sub, iat, exp, and aud, check JWT expiry time in human readable format, or verify the token structure before implementing JWT validation in your code. The expiry countdown tells you immediately if a token is still valid or has already expired. A Verify signature panel goes a step further than decoding: paste the shared secret (for HS256/384/512) or the PEM-encoded public key (for RS/PS/ES algorithms) and the tool checks, using the Web Crypto API, whether the signature actually matches — confirming the token wasn't altered and really was signed with that key, not just that it's structurally well-formed. Unlike some online JWT tools, ToolNinja's JWT decoder runs 100% in your browser using JavaScript — your token and any key material you provide for verification never leave your machine. It's a privacy-first alternative to jwt.io for developers who work with sensitive authentication tokens. No login, no account, no server calls. Just paste and decode.
When to use it
- →Debugging authentication failures by inspecting what claims the token contains
- →Checking whether a token is expired without waiting for an API call to fail
- →Understanding what data your identity provider (Auth0, Cognito, Clerk) puts in the payload
- →Verifying the algorithm field in the header during a security review
- →Confirming a token's signature actually matches a given secret or public key, not just that it decodes
Tips
- ◆JWTs are Base64URL-encoded, not encrypted. Anyone who has the token can read the payload.
- ◆The exp claim is a Unix timestamp — compare it to the current time to check expiry.
- ◆Never store sensitive user data (passwords, SSNs, credit cards) in JWT claims.
- ◆The signature validates that the token was issued by the expected server — use the Verify signature panel with the actual secret or public key to check it, rather than assuming a well-formed token is a validly signed one.
- ◆Click 'Use in a cURL request' to quickly test an endpoint with this token, or convert straight to Python/JavaScript code
Frequently asked questions
Does this tool verify the JWT signature?
Yes — the Verify signature panel checks it for you, using the Web Crypto API entirely in your browser. For HMAC algorithms (HS256/384/512) provide the shared secret; for RSA and ECDSA algorithms (RS/PS/ES) provide the PEM-encoded public key. Neither the token nor the key material you enter is ever sent anywhere.
What does 'Token Expired' mean?
The exp (expiration) claim in the payload is a Unix timestamp. If the current time is past that timestamp, the token is expired and most APIs will reject it with a 401 Unauthorized response. You need to re-authenticate to get a fresh token.
Is it safe to paste my production JWT here?
The decoder runs entirely in your browser — nothing is sent to a server. That said, production JWTs contain real user data and grant access to real systems. Treat them like passwords: don't paste them into unfamiliar tools, and rotate them if you suspect exposure.
What's the difference between HS256 and RS256?
HS256 (HMAC-SHA256) uses a shared secret — both the issuer and verifier need the same key. RS256 (RSA-SHA256) uses a key pair — the issuer signs with a private key and anyone can verify with the public key. RS256 is preferred for multi-service architectures because services can verify tokens without holding the signing secret.