JWT Decoder
Decode a JWT's header and claims with expiry checks, and verify HMAC, RS256, ES256, or PS256 signatures locally.
Decoded Header
{
"alg": "HS256",
"typ": "JWT"
}Decoded Payload
{
"sub": "1234567890",
"name": "Ada Lovelace",
"admin": true,
"iss": "envless",
"iat": 1700000000,
"exp": 2000000000
}Claims
subSubject1234567890nameNameAda LovelaceadmintrueissIssuerenvlessiatIssued at1700000000expExpires2000000000Signature
alg: HS256ad1EjTyBdIm91wB8EVGT7Ut_VMYLHiguyddrMvOiqAAHow to decode a JWT
Inspect any token’s header, payload, and claims in seconds.
- 1
Paste your JWT
Drop your token into the input field. Any JWT in standard header.payload.signature format is recognized instantly.
- 2
Read the decoded claims
See the header and payload formatted as JSON, with every standard claim broken out and explained.
- 3
Check expiry and verify
Issue and expiry times are shown in your local timezone. Optionally enter an HS256 secret to verify the signature.
- 4
Store tokens safely in Envless
For real API tokens and secrets, store and share them end-to-end encrypted in Envless instead of pasting them into chat or plaintext files.
Why use the Envless JWT decoder?
A private, local-only decoder from a team obsessed with token and secret security.
Instant header & payload decode
Automatically parse and pretty-print both JWT sections as readable JSON, so you can see the full structure of any token at a glance.
Human-readable claims
View standard claims (iss, sub, aud, exp, nbf, iat, jti) with Unix timestamps converted to your local time and a clear valid / expired status.
HS256 signature verification
Optionally paste your HMAC secret to verify that a token was signed correctly and has not been tampered with, computed locally with Web Crypto.
100% local and private
Your token never leaves your browser. Everything runs client-side with zero server transmission, logging, or storage, matching the Envless zero-trust ethos.
Verify RS256, ES256, and PS256
Paste the issuer’s SPKI PEM public key to verify asymmetric signatures, RS256/384/512, ES256/384/512, and PS256/384/512, locally with the Web Crypto API, alongside HMAC checks.
JWT decoder FAQ
Everything you need to know about decoding and verifying JSON Web Tokens.
Yes. The decoder runs 100% in your browser using JavaScript. Your token is never sent to our servers, logged, or stored, it is decoded locally on your device only.
A JWT (JSON Web Token) is a compact, URL-safe string that encodes claims about a user or service. It has three dot-separated parts: a header (algorithm and type), a payload (the claims), and a signature used for verification.
Yes. For HS256, HS384, or HS512, paste your shared secret. For asymmetric tokens, RS256/384/512, ES256/384/512, and PS256/384/512, paste the issuer’s SPKI PEM public key. Either way, the decoder validates the signature locally.
The decoder reads the exp (expiration) claim, converts it to your local time, and shows a valid or expired status. If the current time is past exp, the token is expired and no longer valid.
Common claims are iss (issuer), sub (subject/user ID), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (unique token ID). The decoder labels each one for you.
Yes, you can decode and inspect the header and payload of any JWT regardless of algorithm. Signature verification works for the HMAC family (HS256/384/512) as well as the asymmetric RS256/384/512, ES256/384/512, and PS256/384/512 families.
To verify an RS256 JWT, or any ES256 or PS256 token, paste the issuer’s SPKI PEM public key into the verification field. The decoder checks the signature locally with the Web Crypto API, and neither the key nor the token ever leaves your browser.
More free tools
Other free, 100% client-side tools from the Envless team.