Catalytic WizAlert — free, private online tools

JWT Decoder

Decode JSON Web Tokens to inspect the header, payload and claims, check expiry, and verify HS, RS, PS and ES signatures locally.

Inspect and verify JSON Web Tokens

A JWT has three Base64URL parts separated by dots: a header (algorithm and type), a payload (the claims) and a signature. This tool decodes the first two and can check the third.

How to use

  1. Paste a token (a leading “Bearer ” is ignored), or click “Try an example”.
  2. Read the decoded header and payload. Time claims like exp and iat are shown as dates.
  3. The badge tells you whether the token has expired.
  4. To verify the signature, enter the secret (HS256/384/512) or paste the PEM public key (RS, PS and ES algorithms).

Good to know

  • Decoding is not verifying: anyone can read a JWT payload, so never put secrets in it.
  • Tokens using alg: none have no signature and should never be trusted.
  • Public keys must be in SPKI format (-----BEGIN PUBLIC KEY-----).
  • Tokens and keys are processed only in your browser.