Waseem

Free tool

JWT decoder

Paste a JWT, read the claims, and verify the signature in the browser. The token and keys never leave this page.

  • Free
  • No signup
  • Nothing stored

Paste a header.payload.signature token. A Bearer prefix is fine.

The token and keys stay in this browser.

Three segments, two JSON objects
The header says how the token was signed. The payload holds the claims. Add a secret or public key to check the signature.

How it works

  1. 01

    Paste the token

    Copy a JWT from an Authorization header, a cookie, or a Next.js auth session. A Bearer prefix is stripped.

  2. 02

    Add the secret or public key

    HS256, HS384, and HS512 use a shared secret. RS, PS, ES, and EdDSA use a public key as PEM, a JWK, or a JWKS document. The header alg picks which one.

  3. 03

    Read the checks

    A green badge means the signature matches. exp, nbf, and iat are shown as a relative phrase and a UTC time. iss and aud are listed beside them.

The header and payload are just JSON

A signed JWT is three base64url segments separated by dots. The first is the header, usually alg and typ. The second is the payload, the claims an app puts in a session. The third is the signature. The header and payload are shown as pretty JSON so you can see why a Next.js auth cookie is expired, aimed at the wrong issuer, or using an algorithm you did not expect.

The signature check uses the alg in the header. HMAC algorithms take the secret as plain text or base64. RSA, RSA-PSS, ECDSA, and EdDSA take a public key: a PEM block, one JWK, or a JWKS document. When the header has a kid, that id selects the key inside the set. exp, nbf, and iat are listed as a relative phrase and a UTC time, next to iss and aud.

A verified signature is still your key

A green badge means those three segments match the secret or public key you pasted. It does not mean the issuer is one you trust. alg: none stays a fail: that header says there is no signature at all. An expired exp is reported beside a valid signature, because the bytes can still be authentic after the clock runs out.

Encode signs a header and payload with HS256, HS384, or HS512. The token and the key stay in this browser. Encrypted tokens have five segments, and this page cannot read those. For the tags around the page that sets the cookie, use the meta tags inspector and the Next.js SEO guide.

FAQ

Read the Next.js SEO guide