JWT Decoder
Decode JWTs and verify HS/RS/ES signatures in your browser with Web Crypto. Tokens and keys never leave your machine. Free, no upload.
About this tool
Paste a JSON Web Token and see its decoded header and payload, with exp/iat/nbf timestamps translated to human-readable ISO dates and an at-a-glance expired/valid status.
Because decoding happens entirely in your browser, this is safe for real tokens in a way that upload-based decoders are not. Optionally paste your HMAC secret or the issuer's public key (PEM or JWK) to verify the signature too, using the browser's built-in Web Crypto API. The key is used in memory only and never transmitted.
Common uses
- Check why an API rejected a token (usually: it expired).
- Inspect which claims and scopes your auth provider actually issues.
- Verify a token's signature against your secret or public key without any third-party service.
- Debug clock-skew issues by comparing iat/nbf/exp timestamps.
Automate via API
The same conversion is available as a REST endpoint for scripts, pipelines, and backends:
curl -X POST https://payloadly.com/api/v1/tools/jwt-decoder \ -H "Content-Type: text/plain" \ -H "X-Api-Key: YOUR_API_KEY" \ --data-binary @input.txt
Worked examples
Real payloads from tools people use daily, with the exact output this converter produces. Every example runs in your browser, so you can load one and adapt it to your own data.
Decode a Shopify App Bridge session token
Shopify App Bridge session tokens are JWTs; decoding shows the dest, aud, and exp claims so you can debug why the Admin API rejected a request. Paste your app's client secret in the key field to also verify the signature.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2V4YW1wbGUtc2hvcC5teXNob3BpZnkuY29tL2FkbWluIiwiZGVzdCI6Imh0dHBzOi8vZXhhbXBsZS1zaG9wLm15c2hvcGlmeS5jb20iLCJhdWQiOiJhMWIyYzNkNGU1ZjZjbGllbnRfaWQiLCJzdWIiOiI4NDIxNTU1MSIsImV4cCI6MTcxNjI0MjYyMiwibmJmIjoxNzE2MjQyMDIyLCJpYXQiOjE3MTYyNDIwMjIsImp0aSI6ImY4YjFjMmQzLTExMTEtMjIyMi0zMzMzLTQ0NDQ1NTU1NjY2NiIsInNpZCI6IjlkMWUyZjNhNGI1YzZkN2U4ZjkwIn0.c2hvcGlmeS1hcHAtYnJpZGdlLXNpZ25hdHVyZS1ub3QtdmVyaWZpZWQ
{
"header": {
"alg": "HS256",
"typ": "JWT"
},
"payload": {
"iss": "https://example-shop.myshopify.com/admin",
"dest": "https://example-shop.myshopify.com",
"aud": "a1b2c3d4e5f6client_id",
"sub": "84215551",
"exp": 1716242622,
"nbf": 1716242022,
"iat": 1716242022,
"jti": "f8b1c2d3-1111-2222-3333-444455556666",
"sid": "9d1e2f3a4b5c6d7e8f90"
},
"notes": {
"expiresAt": "2024-05-20T22:03:42.000Z (EXPIRED)",
"issuedAt": "2024-05-20T21:53:42.000Z",
"notBefore": "2024-05-20T21:53:42.000Z",
"signature": "Present but NOT verified. Decoding does not prove authenticity; paste the HMAC secret or the issuer's public key (PEM or JWK) in the key field to verify it locally."
}
}JWT notes
A JSON Web Token (JWT) is three base64url-encoded segments (header, payload, signature) joined by dots. Decoding reveals the claims; it does not verify the signature.
- Decoding a JWT does not validate it; signature verification requires the secret or public key.
- Timestamps (`exp`, `iat`, `nbf`) are Unix epoch seconds.
- Never paste production tokens into tools that upload data; this one runs entirely in your browser.
JSON notes
JSON (JavaScript Object Notation) is the standard interchange format for web APIs, config files, and log pipelines. It is strict: keys must be double-quoted, trailing commas are invalid, and comments are not allowed.
- JSON does not support comments; they are stripped or rejected by parsers.
- Trailing commas after the last element are invalid JSON.
- Integers beyond 2^53 lose precision in JavaScript-based parsers.
Frequently asked questions
Is my data uploaded to a server?
No. This tool runs entirely in your browser using JavaScript, and there are no ads on the page. Nothing you paste or drop here is uploaded, logged, or stored, and you can verify that yourself: open your browser's developer tools and watch the Network tab while you convert (no requests leave the page), or disconnect from the internet after the page loads and keep working.
Does this verify the JWT signature?
Yes, optionally. Paste the HMAC secret (HS256/384/512) or the issuer's public key in SPKI PEM or JWK format (RS256/384/512, ES256/384/512) into the key field and the signature is verified locally with the Web Crypto API. Without a key, the tool decodes only, and the output says the signature was not verified. Try it: the sample token verifies with the secret your-256-bit-secret.
Is it safe to paste a secret or private key here?
Only paste secrets and public keys, never private keys (verification does not need them). The key is used in browser memory by the Web Crypto API and is never sent, logged, or stored, which you can confirm in the Network tab while verifying.
Is there a size limit or a fee?
The browser tool is free with no signup and comfortably handles files up to tens of megabytes (limited by your device's memory). For automated or bulk processing inside your own scripts and pipelines, use the paid REST API.
Related tools
Flatten nested JSON to single-level dot-notation keys in your browser. Ideal for CSV prep, diffing, and key inventories. Free, no upload.
Generate a JSON Schema (draft-07) from sample JSON in your browser. Infers types, required fields, and array item shapes. Free, private.
Format and beautify JSON in your browser with 2-space, 4-space, or tab indentation. Errors reported with line and column. Free, no upload.
Minify JSON in your browser: strip all whitespace for smaller payloads and env vars. Shows size savings. Free, private, no upload.