Skip to content
Marvin's Toolbox.

Search tools

Type to filter all tools

JWT Decoder

Paste a JSON Web Token to see its header and payload as formatted JSON, with the token color coded so each part maps to its output. Explains the registered claims, shows expiry as readable dates, flags expired tokens and can verify the signature with a secret or public key.

Everything runs locally in your browser. Your data never leaves your device.

HeaderPayloadSignature

Line breaks, surrounding whitespace and a Bearer prefix are all fine.

Nothing decoded yet
Paste a JSON Web Token above, or use the sample, to see its header, payload and claims.

Next steps

Send this tool's output straight into another tool.

JSON Inspector

Paste JSON to explore it as a collapsible, searchable tree, hide the fields you don't need, and see the structure it implies as a badge-annotated schema and a copyable TypeScript interface.

devjson

Config Converter

Convert config and data between JSON, YAML, TOML, JSON5, INI, XML, CSV and .env. Type or paste on the left, pick the output format on the right, and copy the result. Includes a format button and a minify toggle.

devconverterconfigjsonyaml

JSON Diff

Compare two JSON documents by structure and see every added, removed and changed key and value with its exact path. Browse the result as a tree, a filterable change list or a line diff, ignore array order, catch type changes and export the changes as a JSON report.

devjson

Text Case Converter

Convert text into every case at once: title case in the APA, AP, Chicago, MLA, Bluebook, AMA and NYT styles, sentence case, upper, lower, camelCase, snake_case, kebab-case and more.

textconverter

Word & Character Counter

Count words, characters, sentences, paragraphs, lines and more as you type, with estimated reading and speaking time.

text

Dedupe Lines

Remove duplicate lines from a list or text, keeping the first occurrence. Optionally ignore case and whitespace, or drop blank lines too.

textdev

Find and Replace

Replace text in two modes: plain find and replace all, or regular expressions with flag controls and capture group references like $1.

textdev

Text Diff

Compare two texts and see every added, removed and changed line highlighted, side by side or inline, with the changed words marked within each line. Ignore case, whitespace or blank lines, read a summary of how much changed, and export the result as a unified diff.

textdev

UUID Decoder

Paste a UUID to see what it carries: version, variant, and for time-based versions the exact timestamp, clock sequence and node. Also shows the raw bytes, the 128-bit integer and the URN form.

devuuid

About the JWT Decoder Tool

This tool decodes a JSON Web Token and lays it out so you can read it. The pasted token is color coded by part, and the header and payload appear as formatted JSON in panes carrying the same colors, so every value points back at the characters it came from.

Each claim in the payload is explained in plain language. Timestamps like exp, nbf and iat show as readable dates in local time and UTC, an expired token gets a clear flag, and you can check the signature with a secret or a public key.

What you can do

  • Decode a JWT and read its header and payload as formatted JSON.
  • Check whether a JWT is expired or not yet valid.
  • Understand the registered claims: iss, sub, aud, exp, nbf, iat and jti.
  • Verify an HS256, HS384 or HS512 signature with the shared secret.
  • Verify RS, PS, ES and EdDSA signatures with a PEM or JWK public key.
  • Convert exp and iat timestamps to readable dates.

How to use the JWT Decoder

  1. 1Paste the token. A Bearer prefix, quotes and line breaks are all fine, and the sample token gives you something to explore.
  2. 2Read the decoded header and payload, and copy either as JSON.
  3. 3Check the claims table for what each claim means and whether the token is still valid.
  4. 4To verify the signature, enter the secret for HS tokens or paste the public key for RS, PS, ES and EdDSA tokens, then click Verify signature.
  5. 5Send the decoded payload to the JSON Inspector to explore it as a tree.

Decoding is not verification

Anyone can decode a JWT. The header and payload are just base64url encoded JSON, so reading them proves nothing about who created the token. Trust comes from the signature check, which needs the secret or public key the token was signed with. The tool keeps an unverified notice on screen until a verification actually succeeds.

A token using alg: none carries no signature at all and gets a clear warning. Most libraries reject such tokens, and so should you.

Supported algorithms

HMAC tokens (HS256, HS384, HS512) verify with the shared secret, entered as raw text or Base64. Asymmetric tokens (RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA) verify with the public key, pasted as a PEM block (SPKI or an X.509 certificate) or as a JWK. Private keys are rejected on purpose, since verification only ever needs the public half.

Credits

Open source does the heavy lifting in this tool. Thank you to:

  • jose

    A complete JavaScript implementation of JWT, JWS, JWE and the rest of the JOSE family.

Everything this site builds on is listed on the credits page.

Related tools

Bcrypt & Argon2 Generator

Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.

securitydev

Checksum Validator

Verify a checksum online: drop a file, paste the expected checksum and see instantly whether they match. The hash type is detected from the checksum itself, covering MD5, SHA-1, SHA-256, SHA-512, BLAKE3, CRC-32 and more, and sha256sum lines or whole checksum files can be pasted as-is.

devsecurity

Email Header Analyzer

Paste raw email headers to trace the Received chain hop by hop with per-hop delays, read the SPF, DKIM and DMARC results, and see every header explained. Helps you spot spoofing and find where a slow email got stuck.

devsecurity

Hash Generator

Hash text or a file with MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE2, BLAKE3, CRC32 and more, all computed live as you type. Compare against an expected checksum and copy any digest.

devsecurity

Invisible Character Revealer

Reveal the characters you can't see in a text: zero-width spaces, non-breaking spaces, bidi marks, control characters and CRLF versus LF line endings. Inspect every occurrence and clean them out with a click.

textdevsecurity

JWT Encoder

Build and sign a JSON Web Token from a header and payload. Supports the HMAC, RSA, ECDSA and EdDSA algorithms real systems use, fills in standard claims like expiry for you, and shows the signed token ready to copy.

devsecurity