About JWT Decoder, Generator & Verifier
JWT Decoder, Generator & Verifier lets you inspect JSON Web Token parts, review time claims, verify a signature with a supplied key, or generate a test token.
Decoding only reads the header and payload; it does not establish who issued the token or whether its claims should be trusted. Verification must use the expected algorithm, key, issuer, audience, and application policy.
How to use this developer tool
- Paste a JWT and decode the header, payload, and signature segments.
- For verification, select the algorithm and provide the matching test key or public key.
- Review exp, nbf, iat, issuer, audience, and algorithm decisions before relying on the result.
Privacy and data handling
JWT processing is designed to run locally. Never paste production signing keys, private keys, or live customer tokens into an online tool; use a redacted test token whenever possible.
Related developer tools
Frequently asked questions
Does decoding a JWT verify it?
No. The first two JWT parts are Base64URL-encoded JSON and can be read without a key. Verification checks the signature with the expected key and algorithm.
What should I check besides the signature?
Check expiration, not-before, issuer, audience, algorithm, and the application rules that decide which claims are required.
Can a JWT contain a password?
It should not. JWT payloads are normally readable by whoever has the token, so keep secrets out of claims.