# Decode a JWT and check its signature

> Paste a JSON Web Token to read its header and payload, see when it expires and check its signature.

Decode a JSON Web Token, see when it expires and verify its HS, RS, PS, ES or EdDSA signature. Runs in your browser. Nothing is stored or sent.

- Tool: [JWT decoder](https://fixmint.cc/jwt-decoder)
- Category: [Web & developer](https://fixmint.cc/developer-tools)
- Fixes: Token expired, or is it valid?
- Runs in the browser: files and text stay on the device, no sign-up, free.

## How to decode a JWT and check its signature

1. Paste the token, or try the example.
2. Type the secret, or paste the public key, to check the signature.
3. Read the verdict, the claims and the security notes.

## Questions

### Is my token sent anywhere?

No. Decoding and signature checks run in your browser with Web Crypto. The token and keys are not stored or sent to a server.

### Why does it say the signature is not checked?

Checking needs the secret for HS256, HS384 or HS512, or the public key for RS, PS, ES and EdDSA tokens. Reading the payload does not prove who signed it. The example token is signed with the secret your-256-bit-secret.

### Can it open an encrypted token?

No. An encrypted token (JWE, five parts) needs the decryption key, which this tool does not take, so it says so and stops there.

### Which key formats work?

A PEM public key that starts with BEGIN PUBLIC KEY, or a JWK in JSON. Certificates (BEGIN CERTIFICATE) and PKCS#1 keys are not read here. EdDSA needs a browser that supports Ed25519.

## Related tools

- [Format JSON](https://fixmint.cc/json-formatter): JSON won’t parse
- [Base64 encode and decode](https://fixmint.cc/base64-encode-decode): Read or make a Base64 string
- [Hash generator](https://fixmint.cc/hash-generator): Does my download match?
- [Webhook signature tester](https://fixmint.cc/webhook-signature-tester): Webhook signature check fails