PocketPlay
中文

JWT Decoder & Encoder

Decode a JSON Web Token, read its claims and expiry, verify HS256 or RS256/ES256 signatures, and build new tokens — all offline.

🔒 Runs in your browser — files never leave your deviceFree · No sign-up

Token

—

Header

Payload

Registered claims

ClaimValueMeaning

No registered claims in this payload.

Verify signature

Secret
Everything stays in your browser — the token and the key are never sent anywhere.

How to decode a JWT

  1. Paste the token. The three dot-separated parts are coloured, and the header and payload are decoded into readable JSON straight away.
  2. Read the claims table: iat, nbf and exp are shown as local dates with how long ago or how far ahead they are, and an expired token is badged in red.
  3. To check the signature, paste the shared secret for HS256/384/512, or a PEM public key for RS256, PS256 or ES256, and press Verify. Use the Encode tab to build and sign a new token.

FAQ

Is my token sent anywhere?

No — and that matters here more than anywhere else, because a JWT is a live credential. Decoding, verifying and signing all run in this page using the browser's built-in WebCrypto. The token, the secret and the key never touch the network, and nothing is stored between visits.

Decoding worked but verification failed — why?

Decoding only unpacks base64url; anyone can read a JWT. Verification recomputes the signature, so it fails if the secret or key is wrong, if the algorithm in the header does not match the key you supplied, or if even one byte of the token was altered. For HS algorithms, remember that many frameworks store the secret base64-encoded — tick that box if yours does.

Which algorithms are supported?

Verification supports HS256/384/512 with a secret and RS256/384/512, PS256/384/512 and ES256/384/512 with an SPKI public key in PEM form. Signing in the Encode tab is HMAC only, so private keys never have to be pasted anywhere. Tokens with alg: none are decoded but always reported as unverified.

Regex TesterHOT Test JavaScript regular expressions live: highlighted matches, capture groups, replace preview and a shareable link. Regex Cheat Sheet A searchable regular expression reference: character classes, anchors, quantifiers, groups, lookaround, flags and Unicode properties, each with a live example. Regex Visualizer Turn a JavaScript regular expression into a railroad diagram you can read at a glance, and export it as SVG or PNG. Code FormatterHOT Format or minify JavaScript, TypeScript, JSON, HTML, CSS, SCSS, Markdown and YAML with Prettier, right in your browser. HTML Preview Write HTML, CSS and JavaScript on the left and see the rendered page instantly on the right, in a sandboxed frame. SQL Formatter Format and beautify SQL for MySQL, PostgreSQL, SQLite, T-SQL, BigQuery and more — or minify it back to one line. Table Generator Fill in a spreadsheet-style grid — or paste from Excel — and get the table as HTML, Markdown, CSV, JSON or LaTeX. Meta Tag Generator Build the whole <head> block — title, description, canonical, Open Graph, Twitter card, favicons and JSON-LD — with live Google and social previews.

All tools →