JWT Decoder

Decode JWT headers + payloads. Surfaces issued, expires, and notBefore timestamps.

100% Private
Your files never leave your device
Lightning fast
Optimised for speed
No sign-up
Use instantly, no account
Encoded token
Decoded entirely in your browser — the token never leaves your device.

Decode a JSON Web Token to inspect its header, payload, and claims — and verify its HMAC signature with your secret, right in the browser. Edit the header or payload and the token re-signs live.

How to use JWT Decoder

  1. 1Paste a JWT (header.payload.signature) into the input.
  2. 2Read the decoded header and payload, plus a plain-English claims table.
  3. 3Enter the shared secret to verify an HS256/384/512 signature.
  4. 4Edit the header or payload to re-issue a new signed token.

Verifying a token’s signature

Decoding a JWT only reveals what’s inside it — anyone can do that, because the header and payload are just Base64. The signature is what proves the token is authentic. Paste your shared secret and Primova recomputes the HMAC (HS256, HS384, or HS512) to confirm the token hasn’t been tampered with, showing a clear Valid or Invalid badge.

Asymmetric algorithms (RS256, ES256, PS256) are verified with the issuer’s public key rather than a shared secret, so those aren’t checked here — but the decoded contents still display in full.

Reading the standard claims

JWTs use short claim names that aren’t obvious at first: iss (issuer), sub (subject or user), aud (audience), iat (issued at), nbf (not before), and exp (expiry). Primova lays these out in a plain-English table and converts each timestamp to a readable date with relative time, so you can spot an expired token at a glance.

Frequently asked questions

Yes, for HMAC algorithms (HS256, HS384, HS512) — enter the shared secret and you’ll see a Valid or Invalid badge instantly. Asymmetric algorithms (RS/ES/PS) need the issuer’s public key, which isn’t entered here.
Decoding and verification happen entirely in your browser — the token and secret are never sent anywhere. That said, treat production tokens with care and avoid sharing your screen.
They’re timestamps: iat is when the token was issued, nbf is the earliest it’s valid, and exp is when it expires. The tool shows each as a readable date plus a relative time like “expires in 2 days”.
Yes. Edit the header or payload fields and, with a secret entered, the token is re-signed live so you can craft test tokens.
Yes — decoding, verifying, and re-signing tokens are all free with no sign-up or limits.

Still have questions?

If you can’t find the answer you’re looking for, our support team is here to help.

Contact Support
Secure Fast Private
More tools

Keep going.

Browse all tools

JSON Formatter

Format, validate, and minify JSON. Catches syntax errors with line + column.

Base64 Encode / Decode

Encode text to base64 or decode base64 back to text. UTF-8 safe.

URL Encode / Decode

Percent-encode strings for URLs, or decode them back. Includes a query string parser.

image

Image Compressor

Compress JPG, PNG, WebP, and AVIF images without quality loss. Free, instant, and 100% private.

pdf

PDF Merger

Combine multiple PDFs into a single file. Drag to reorder, processed in your browser.

image

Image Resizer

Resize images by pixels or percentage. Presets for Instagram, X, HD, 4K — and bulk supported.