drawflow.io — Mermaid sequence diagram editor
JWT

JWT Decoder Online

Decode JWT tokens instantly with this free JWT decoder online. Inspect header and payload claims, check expiration, and verify HS256 or RS256 signatures — 100% client-side for maximum privacy.

How to use the JWT decoder

  1. 1. Paste an encoded JWT

    Paste a complete JSON Web Token into the input area. The tool splits the header, payload, and signature segments and decodes the JSON parts automatically.

  2. 2. Review claims and expiry

    Inspect standard claims such as iss, sub, aud, exp, and iat in a readable table. Expired tokens are flagged so you can tell whether a failure is due to clock skew or an old session.

  3. 3. Verify signatures when needed

    For HS256 tokens, supply the shared secret. For RS256 tokens, paste the public key in PEM format. Verification runs locally in your browser without sending the secret to any server.

  4. 4. Try sample tokens

    Load built-in examples to see how valid and expired tokens differ. Replace sample values with your own test tokens from development environments.

Common use cases

  • Debugging authentication in development

    Quickly check whether a token contains the roles, tenant ID, or scopes your API expects before tracing server logs.

  • Support and customer success

    Validate format and expiry when users report login issues. Support staff can confirm whether a token is malformed or simply expired.

  • Security reviews

    Inspect algorithm choice and sensitive claims before approving integrations. Teams verify tokens are not using deprecated algorithms or missing audience checks.

  • Teaching OAuth and OpenID Connect

    Demonstrate how ID tokens and access tokens differ by decoding real examples side by side in workshops.

  • Testing API gateways

    Paste tokens issued by staging identity providers to confirm custom claims survive signing and verification steps in your edge layer.

Frequently asked questions

Is it safe to paste production JWTs here?
Decoding happens entirely in your browser and tokens are not uploaded. Still treat production tokens as secrets—prefer redacted staging tokens when possible.
Which algorithms can be verified?
The tool supports HS256 and RS256 verification when you provide the correct secret or public key. Other algorithms are decoded but not verified.
Why does verification fail on a valid token?
Common causes include clock skew on exp, wrong secret or public key, altered payload, or algorithm mismatch between header and key material.
Do you store tokens I paste?
No. Token content is processed in memory in your browser session and is not persisted on drawflow.io servers.