Which algorithms can be verified?

HS256/384/512 with a shared secret, RS256/384/512 and PS256/384/512 with an RSA public key, and ES256/384/512 with an EC public key on P-256, P-384 or P-521. Keys can be pasted as PEM (SPKI, PKCS#1, an X.509 certificate or even a private key), as a JWK, or as a JWKS document or URL.

How does "From iss" find the JWKS?

It reads the iss claim and tries OpenID Connect discovery (/.well-known/openid-configuration), then RFC 8414 (/.well-known/oauth-authorization-server) and finally /.well-known/jwks.json, then picks the key whose kid matches the token header.

Why does the payload show future-dated fields?

JWTs carry exp, nbf and iat as seconds since the Unix epoch. The tool converts them to local dates with relative text and flags non-standard values such as numeric strings or millisecond timestamps.

Can I edit claims and re-sign?

Yes. The Edit & sign tab seeds editors from the token; change the claims, choose the algorithm, supply the secret or private key and click Sign. The Builder tab creates access, ID and refresh tokens from presets with a lifetime picker.

JWT Decoder

Paste any JSON Web Token to decode its header and payload with claim-by-claim explanations and live expiry status. Verify the signature with a shared secret (UTF-8, Base64 or hex), a PEM public key or certificate, a JWK, or a JWKS fetched by URL or discovered from the iss claim — HS256/384/512, RS256/384/512, PS256/384/512 and ES256/384/512 via Web Crypto. Edit claims and re-sign, build access / ID / refresh tokens from presets, and get security findings such as alg:none, algorithm confusion, missing exp or long-lived tokens.

Fetches URLs via the FizzKit relay — nothing is stored

Open fullscreen for long tokens and side-by-side claim tables

JWT

0 chars · 1 line

Samples:⌘↵ verifies (or signs in Edit / Builder)

Paste a JWT to decode it

Header and payload are decoded instantly with claim descriptions and expiry status. Verify HS / RS / PS / ES signatures with a secret, PEM, JWK or a JWKS URL, then edit and re-sign.

JWT Debugger

Verify and sign JWTs with a secret, public key or JWKS.

Base64 Encode / Decode

Encode text, hex or any file to Base64 (and Base32, Base58) and decode back — with data URIs and image preview.

HMAC Generator & Verifier

Sign and verify HMAC-SHA256/SHA1/SHA512/MD5/SHA-3 signatures with Stripe, GitHub, Shopify, Slack and Twilio presets.

Hash Generator

MD5, SHA-1, SHA-256/384/512, SHA-3, CRC32 and xxHash32 for text, lines and files — with verify and checksum export.

URL Parser & Query Editor

Break any URL into parts, edit query params live, unwrap nested redirect URLs, decode ad macros, build UTMs and follow redirects.

How to use JWT Decoder

1Paste a JWT (or drop a .jwt / .txt file) — the header, payload and signature are decoded instantly with colour-coded segments.
2Read the Decoded tab: registered claims are explained and exp / nbf / iat show relative times and status badges.
3Open Verify, pick the key source — secret, PEM public key, JWK / JWKS JSON or a JWKS URL (use "From iss" to discover it) — and the signature is checked automatically.
4Review the security checks (alg none, algorithm confusion, missing exp, long-lived tokens) and adjust the clock-skew allowance if needed.
5Use Edit & sign or Builder to change claims and produce a freshly signed token, then copy it or load it back as input.

About JWT Decoder

JWT Decoder is part of FizzKit — a collection of focused developer and ad-tech tools. This tool uses the FizzKit relay to fetch public URLs on your behalf (so browser CORS rules do not get in the way); fetched content is returned to your browser and not stored.

Frequently asked questions

Decoding, verification and signing run entirely in your browser with the Web Crypto API. Secrets and keys are kept in memory only and never written to local storage. The only network call is the optional JWKS fetch, which goes through the FizzKit relay because identity providers rarely send CORS headers; the token itself is never sent.

Related tools