Is my token sent anywhere when I decode it?

No. Decoding and verification both run in your browser tab, and the token is not logged or stored. Only the parts of the page you can see ever hold it.

Does decoding a JWT prove that it is valid?

No. Anyone can craft a token whose payload claims anything at all. Decoding shows the claims; only signature verification with the correct key shows the token is authentic, which is why decoded claims are labelled unverified until you verify them.

Which algorithms can it verify?

HS256, RS256, PS256, and ES256. A token whose header advertises any other algorithm is rejected as not allowed instead of being verified with a weaker check.

What key format does verification expect?

For HS256, the shared secret as text, interpreted as UTF-8 or Base64 according to the encoding selector. For RS256, PS256, and ES256, the public key as a JWK JSON object or a PEM-encoded SPKI public key block.

Does it fetch keys from the jku or x5u header?

No. Remote key URLs in the header are never requested. Keys are only ever the ones you paste, which keeps a malicious token from pointing verification at a key it controls.

Can it create or re-sign a token?

No. This page only inspects and verifies existing tokens; it does not issue, edit, or refresh them.

Why does my expiry date look wrong?

The exp, iat, and nbf claims are Unix seconds, not milliseconds. A value in milliseconds decodes to a date far in the future, which is usually a sign that whoever issued the token multiplied by 1000 by mistake.

JWT Decoder | ToolFlowy

JWT token

The signature is not verified — this is a local inspector only. Tokens never leave your browser.

Paste a token above — the header and payload are decoded here, locally.

How to decode a JWT and check its signature

JWT Decoder splits a JSON Web Token into its header and payload, formats the claims, and turns the numeric timestamps into readable dates so you can see at a glance whether a token has expired. Decoding happens in this browser tab, so the token — and any access it grants — is never sent to a server. When you also have the key, the same page verifies the signature with the Web Crypto API instead of trusting the claims blindly.

Decode and verify a token in four steps

Paste the tokenPaste the JWT into the token field, or press Load example to try the page with a demo token. A value that is not three Base64url segments separated by dots is reported as invalid rather than half-decoded.
Read the header and payloadThe header shows the algorithm and token type; the payload shows the claims as formatted JSON. Registered time claims are rendered alongside the raw values, so iat, exp, and nbf appear as dates.
Check the validity badgeA badge summarises whether the token is currently within its window: valid, expired, or not yet valid. In decode-only mode the claims are labelled unverified, because an unsigned read tells you what a token says, not that it is genuine.
Switch to Verify signature when you hold the keyChoose the verify mode and paste the key. HS256 takes the shared secret, read as UTF-8 or Base64 depending on the encoding you select. RS256, PS256, and ES256 take the public key as a JWK object or a PEM-encoded SPKI block. The result reports verified, signature mismatch, invalid key, or algorithm not allowed.

What people use JWT Decoder for

Find out why an API call returns 401Decode the token your client actually sent and compare exp against now, or check that the audience and scope claims are the ones the API expects.
Confirm what an identity provider issuedInspect the claims in an OIDC ID token — issuer, subject, nonce, and the algorithm in the header — while wiring up a login flow.
Verify a signature during an integration reviewPaste the provider's public JWK and confirm that the token really was signed by the key you were told to trust, and with the algorithm you expected.
Inspect a production token without leaking itA JWT is a bearer credential. Because decoding runs locally, you can look at a live token from a support ticket without pasting it into a third-party service that logs its inputs.

JWT Decoder questions

Is my token sent anywhere when I decode it?: No. Decoding and verification both run in your browser tab, and the token is not logged or stored. Only the parts of the page you can see ever hold it.
Does decoding a JWT prove that it is valid?: No. Anyone can craft a token whose payload claims anything at all. Decoding shows the claims; only signature verification with the correct key shows the token is authentic, which is why decoded claims are labelled unverified until you verify them.
Which algorithms can it verify?: HS256, RS256, PS256, and ES256. A token whose header advertises any other algorithm is rejected as not allowed instead of being verified with a weaker check.
What key format does verification expect?: For HS256, the shared secret as text, interpreted as UTF-8 or Base64 according to the encoding selector. For RS256, PS256, and ES256, the public key as a JWK JSON object or a PEM-encoded SPKI public key block.
Does it fetch keys from the jku or x5u header?: No. Remote key URLs in the header are never requested. Keys are only ever the ones you paste, which keeps a malicious token from pointing verification at a key it controls.
Can it create or re-sign a token?: No. This page only inspects and verifies existing tokens; it does not issue, edit, or refresh them.
Why does my expiry date look wrong?: The exp, iat, and nbf claims are Unix seconds, not milliseconds. A value in milliseconds decodes to a date far in the future, which is usually a sign that whoever issued the token multiplied by 1000 by mistake.