Loading…
Loading…
Decode a JSON Web Token to read its header and claims, see when it expires, and verify its signature with a secret, a public key, or a JWKS — all without the token leaving your browser.
Also covers: JWT decoder · JWT inspector · JWT debugger · JWT verifier
Paste a token to decode it.
Paste a token to decode it.
Paste a JWT (starting with eyJ), with or without "Bearer ", or click Sample. It's decoded instantly: header, payload, and signature are color-coded.
The claims table explains standard claims like iss, sub, aud, and scope, converts exp, nbf, and iat to dates, and says whether the token is valid, expired, or not valid yet.
Enter the secret for HS256/384/512 tokens, or paste the public key (PEM, certificate, JWK, or JWKS) for RS, PS, ES, and EdDSA tokens. The check runs with your browser's Web Crypto.
Decoding and verification run entirely in your browser — the token, secrets, and keys are never sent anywhere. Still, a valid token is a password for as long as it lasts, so prefer expired or test tokens, and never paste production secrets anywhere you don't control.
A signed JWT (JWS) is only Base64URL-encoded, not encrypted. The signature proves who issued it and that it wasn't changed, but it doesn't hide the claims. Never put secrets or personal data in a JWT you don't want the holder to read.
Identity providers publish their keys as a JWKS, usually at /.well-known/jwks.json (found via /.well-known/openid-configuration). Paste that JSON and the key matching the token's kid is used.
The token has no signature at all. Libraries must reject it unless explicitly configured otherwise; accepting unsigned tokens is a well-known authentication bypass.
A JWE has five parts instead of three. Its header can be read, but the payload is encrypted and needs the recipient's private key, so it can't be decoded here.
Data
Format, validate, and minify JSON in your browser. Paste it, upload a file, or load it from a URL. Errors show the exact line and column.
C# / .NET
Paste JSON and get C# model classes or records, ready for System.Text.Json or Newtonsoft.Json. Nested objects, arrays, nullable types, dates, and GUIDs are inferred for you.
SQL
Format and beautify SQL queries for SQL Server (T-SQL), PostgreSQL, MySQL, Oracle, and more. Set the indentation, keyword case, and layout, and get the exact line of any syntax error.
Data
Format, validate, and minify XML (config files, .csproj, SOAP, RSS) in your browser. Entities, CDATA, and mixed content are kept exactly as written, and errors show the line and column.
Data
Format and validate YAML (docker-compose, Kubernetes, GitHub Actions) without losing comments, or convert YAML to JSON. Errors show the exact line and column.
Web
Beautify HTML pages and fragments without changing how they render. Inline spacing, <pre>, and scripts stay intact, and embedded CSS and JavaScript can be formatted too.