JWT Decoder
Paste a JWT to decode its header, payload, and claims with local expiry checks, and verify HMAC or RS256/ES256/PS256 signatures with the issuer’s PEM public key.
Decoded Header
Decoded Payload
Claims
Signature
alg: —How to decode a JWT
Inspect any token’s header, payload, and claims in seconds.
- 1
Paste your JWT
Drop your token into the input field. Any JWT in standard header.payload.signature format is recognized instantly.
- 2
Read the decoded claims
See the header and payload formatted as JSON, with every standard claim broken out and explained.
- 3
Check expiry and verify
Issue and expiry times are shown in your local timezone. Optionally enter an HS256 secret to verify the signature.
- 4
Store tokens safely in Envless
For real API tokens and secrets, store and share them end-to-end encrypted in Envless instead of pasting them into chat or plaintext files.
Why use the Envless JWT decoder?
A private, local-only decoder from a team obsessed with token and secret security.
Instant header & payload decode
Automatically parse and pretty-print both JWT sections as readable JSON, so you can see the full structure of any token at a glance.
Human-readable claims
View standard claims (iss, sub, aud, exp, nbf, iat, jti) with Unix timestamps converted to your local time and a clear valid / expired status.
HS256 signature verification
Optionally paste your HMAC secret to verify that a token was signed correctly and has not been tampered with — computed locally with Web Crypto.
100% local and private
Your token never leaves your browser. Everything runs client-side with zero server transmission, logging, or storage — matching the Envless zero-trust ethos.
Verify RS256, ES256, and PS256
Paste the issuer’s SPKI PEM public key to verify asymmetric signatures — RS256/384/512, ES256/384/512, and PS256/384/512 — locally with the Web Crypto API, alongside HMAC checks.
JWT decoder FAQ
Everything you need to know about decoding and verifying JSON Web Tokens.
Yes. The decoder runs 100% in your browser using JavaScript. Your token is never sent to our servers, logged, or stored — it is decoded locally on your device only.
A JWT (JSON Web Token) is a compact, URL-safe string that encodes claims about a user or service. It has three dot-separated parts: a header (algorithm and type), a payload (the claims), and a signature used for verification.
Yes. For HS256, HS384, or HS512, paste your shared secret. For asymmetric tokens — RS256/384/512, ES256/384/512, and PS256/384/512 — paste the issuer’s SPKI PEM public key. Either way, the decoder validates the signature locally.
The decoder reads the exp (expiration) claim, converts it to your local time, and shows a valid or expired status. If the current time is past exp, the token is expired and no longer valid.
Common claims are iss (issuer), sub (subject/user ID), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (unique token ID). The decoder labels each one for you.
Yes — you can decode and inspect the header and payload of any JWT regardless of algorithm. Signature verification works for the HMAC family (HS256/384/512) as well as the asymmetric RS256/384/512, ES256/384/512, and PS256/384/512 families.
To verify an RS256 JWT — or any ES256 or PS256 token — paste the issuer’s SPKI PEM public key into the verification field. The decoder checks the signature locally with the Web Crypto API, and neither the key nor the token ever leaves your browser.
More free tools
Other free, 100% client-side tools from the Envless team.
Ship secrets, not chaos.
Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.