About this tool
JWTViewer is a zero-upload token inspector. Most online decoders send your token to a backend — a real risk, since a live JWT is often a working session credential. Here, decoding happens directly in your browser tab; you can load the page, go offline, and it keeps working.
Timestamps in exp, iat and nbf convert to your local timezone automatically, and the status banner shows at a glance whether the token is valid, expired or not yet active. More free tools at dec0de.dev — Base64, JSON formatter, UUIDs and more.
A JSON Web Token is three Base64url parts separated by dots: a header, a payload of claims, and a signature. The first two are only encoded, not encrypted — so anyone can read them, which is exactly what this decoder does. The signature is what actually matters for trust: it proves the token was issued by someone holding the secret or private key and has not been altered. Standard claims like iss, sub, aud, exp and iat are explained inline, and the HS256 check lets you confirm a signature when you have the shared secret.
Frequently asked questions
Is a JWT encrypted?
No. A standard JWT is only Base64url-encoded, not encrypted, so anyone can read the header and payload. Never put secrets in a JWT payload; the signature protects integrity, not confidentiality.
Can I verify a JWT signature here?
Yes. For HS256, enter the shared secret and the tool recomputes the HMAC. For RS256/RS384/RS512/ES256/ES384/ES512, paste the issuer’s public key (PEM) or load a JWKS and the tool verifies with the Web Crypto API — all in your browser, nothing is sent anywhere.
What is a JWKS and how do I use one here?
A JWKS ("JSON Web Key Set") is a small public JSON document — usually at a URL like /.well-known/jwks.json — that an identity provider (Auth0, Okta, Cognito, your own auth server…) publishes so anyone can verify tokens it signs with RS256/ES256. Enter the JWKS URL and click Fetch (or paste the JSON directly), and the tool lists each key’s ID, algorithm and type, automatically matching the one whose "kid" fits your decoded token’s header.
Why does my JWT show as expired?
The exp claim is a Unix timestamp; if it is earlier than now, the token is expired. The tool converts exp, iat and nbf to your local time so you can see exactly when it lapsed.
Is my token sent to a server?
No. Decoding and the HS256 check happen entirely in your browser. Your token and secret are never uploaded — safe to paste production tokens while debugging.