Decode Copy Paste Save History
Full JWT
Rendered JWT EMPTY SIGNATURE UNKNOWN
Learn more
Back to tool

JWT Decoder, Editor, Signer, and Validator

The JSON.rs JWT tool turns opaque tokens into readable authentication data. Decode headers, inspect claims, edit payloads, sign test tokens, and validate signatures locally while debugging APIs, identity providers, staging environments, and authorization flows.

Decode JWT Claims

A JWT is easy to copy but hard to reason about in its compact form. Paste a token to reveal the header, payload, signature state, timestamps, issuer, subject, audience, scopes, and custom claims in a structure that is easy to inspect.

  • Inspect header values such as alg, typ, and key identifiers.
  • Read claims including iss, sub, aud, exp, iat, and custom fields.
  • See human-readable hints for expiry and issued-at timestamps.
  • Edit decoded fields and rebuild tokens for development testing.

Validate Tokens Locally

Signature validation helps separate bad data from bad configuration. Add an HMAC secret or RSA public key to confirm whether a token was signed with the expected key, then use history and autosave to move between recent debugging cases.

  • Validate HMAC signatures for HS256, HS384, and HS512 tokens.
  • Verify RSA signatures for RS256, RS384, and RS512 tokens.
  • Sign tokens with supported HMAC secrets or RSA private keys.
  • Keep recent tokens in browser storage for repeat debugging sessions.

Useful for Authentication Debugging

Authentication failures often hide in small details: expired tokens, wrong audiences, missing scopes, unexpected algorithms, copied whitespace, or mismatched signing keys. A readable decoder helps confirm what your API actually receives.

Local Token Inspection

The JWT page is built for browser-side inspection. Decoding, editing, signing, validation, autosave, and history stay local, which is especially useful for test credentials, staging tokens, internal services, and private API payloads.

Header, Payload, and Signature

A JSON Web Token contains three Base64URL sections. This tool separates those sections, renders the JSON clearly, and shows whether the signature can be verified with the key material you provide.

Pair with JSON and Text Diff Tools

After decoding a JWT, use the JSON formatter to clean up copied claims or Text Diff to compare two token payloads, permission sets, or environment-specific authentication responses.