Decode and verify JWT tokens with color-coded display. Free, private, runs in your browser.
100% private — your files never leave your browser. All processing happens locally on your device.
🔒 Your token never leaves this browser — all decoding happens locally
A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange between services. JWTs consist of three base64url-encoded parts separated by dots: a header (algorithm and type), a payload (claims and data), and a signature (cryptographic verification). JWTs are the standard authentication mechanism for modern APIs, single sign-on systems, and mobile applications. Understanding their contents is essential for debugging auth flows.
Developers frequently need to inspect JWT tokens during development, debugging, and security audits. Common scenarios include: checking why authentication is failing (expired token, wrong issuer), verifying the claims a token contains before trusting it, debugging OAuth and OpenID Connect flows, and auditing what data is being transmitted in tokens. Since JWT payloads are base64-encoded (not encrypted), decoding reveals their contents instantly.
Paste a JWT token and the tool instantly splits it into its three parts, base64url-decodes the header and payload, and displays them as formatted JSON with color coding — orange for the header, purple for the payload, and blue for the signature. Standard claims like expiration (exp), issued-at (iat), and issuer (iss) are labeled and timestamp claims are converted to human-readable dates. You can optionally verify the signature by providing your secret or public key.
This is one of the safest JWT decoders available. All decoding and verification happens entirely in your browser using the Web Crypto API — your token is never transmitted to any server. Many popular JWT tools process tokens server-side, which means your authentication tokens could be logged or intercepted. With Convertful, your tokens stay on your device.
Yes. All decoding happens in your browser. Your token is never sent to any server. This is safer than many alternatives that process tokens server-side.
Yes. Enter your secret (for HMAC) or public key (for RSA/ECDSA) to verify the token's signature. Verification also happens entirely in your browser using the Web Crypto API.
HS256, HS384, HS512 (HMAC), RS256, RS384, RS512 (RSA), and ES256, ES384, ES512 (ECDSA).
Yes. The tool automatically detects the 'exp' claim and shows whether the token is expired, valid, or not yet valid, with a human-readable time remaining.