Mr Calcu | Instantly decode JWTs, verify signatures, and uncover hidden risks in your tokens—no guesswork, just clarity.

Decode and verify JWT tokens instantly. Empower your security workflows and uncover hidden risks with our trusted, developer-friendly JWT tool.

Jwt Decode & Verify Tool

JSON Web Token (JWT)

Secret or Private Key

Signing Algorithm

Jwt Decode & Verify Tool Guidelines

You’ve got this—verifying a JWT is easier than you think!

Steps to Use the JWT Decode & Verify Tool

Paste your JWT token: Format must be header.payload.signature
Select the signing algorithm: Match the one used when the token was issued
Enter verification key: Secret (HMAC) or public key (RSA/ECDSA)
Review the decoded results: Header, payload, and claims will be displayed
Check verification status: Valid tokens confirm data integrity and authenticity

Best Practices

Inspect time-based claims like exp, iat, and nbf
Handle tokens with a clock skew buffer when verifying time-sensitive claims
Never trust decoded payloads without signature verification
Use HTTPS to transmit JWTs to prevent man-in-the-middle attacks

Jwt Decode & Verify Tool Description

What is a JSON Web Token (JWT)?

JWT is a compact, URL-safe mechanism for securely transmitting information between parties. As defined in RFC 7519, it encodes structured claims in a way that ensures confidentiality and integrity.

JWT Structure

A JWT consists of three base64url-encoded segments separated by dots:

Header: Metadata including token type and signing algorithm
Payload: The claims or statements about an entity (e.g., user)
Signature: Cryptographic proof that the token hasn’t been tampered with

Supported Algorithms

Symmetric: HMAC (HS256, HS384, HS512)
Asymmetric: RSA (RS256, RS384, RS512), ECDSA (ES256, ES384, ES512)

Signature Verification

For HMAC:

HMACSHA256(base64urlEncode(header) + "." + base64urlEncode(payload), secret)

If the computed signature doesn't match the token's, verification fails — indicating possible tampering.

Pro Tip: Always verify the alg field in the JWT header to prevent downgrade attacks. Never allow none unless explicitly and securely handled.

Real-World Case Study: Mobile App Authentication

Mobile app logs in a user and receives a JWT signed with RS256
Client uses this token for future requests
Backend verifies the signature using the public key

Real-World Case Study: Multi-Tenant SaaS Access

JWTs include tenant ID and user role in the payload
Backend uses these claims to enforce access control
Signature check prevents impersonation between tenants

Get started now—decode your first JWT and secure your tokens in seconds.

Example Calculation

Token Part	Description	Example (Base64url Encoded)
Header	Specifies algorithm and token type	`eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9`
Payload	Contains user-defined claims such as `sub`, `exp`, `iat`, `nbf`, and `aud`	`eyJzdWIiOiAiMTIzNDU2IiwgImV4cCI6IDE2ODk4ODAwMDAsICJpYXQiOiAxNjg5ODc2NDAwLCAibmJmIjogMTY4OTg3MzAwMCwgImF1ZCI6ICJhcGkuZXhhbXBsZS5jb20ifQ`
Signature	Cryptographic signature for validation, computed over the header and payload using the specified algorithm and key	`dGVzdF9zaWduYXR1cmVfYmFzZTY0dXJs`

Frequently Asked Questions

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties.

Enter your JWT token, provide the secret or private key, and select the signing algorithm to decode and verify your token.

Signature mismatch indicates that the token has been tampered with or was signed with a different key. Always ensure the correct algorithm and key are used.

The <code>exp</code> and <code>iat</code> claims are validated against the current system time. Tokens with past expiration or future issuance will fail verification unless time skew is handled.

Yes, decoding a JWT does not require a key and simply base64url-decodes the header and payload. However, this provides no security unless the signature is verified.

Typical algorithms include HS256, HS384, HS512 (HMAC) and RS256, RS384, RS512 (RSA), and ES256, ES384, ES512 (ECDSA). Your tool must match the algorithm used during token creation.

Yes. Common pitfalls include failing to verify tokens, using 'none' algorithm, not rotating secrets, and insecure key storage. Always follow security best practices.

No, standard JWTs are not encrypted. Use JWE (JSON Web Encryption) if you require confidentiality of the payload.

The signature might be invalid due to an incorrect secret/public key, wrong algorithm selection, or a token modified in transit. Always check these elements when troubleshooting.

Mr Calcu | Instantly decode JWTs, verify signatures, and uncover hidden risks in your tokens—no guesswork, just clarity.

Jwt Decode & Verify Tool

Jwt Decode & Verify Tool Guidelines

Steps to Use the JWT Decode & Verify Tool

Best Practices

Jwt Decode & Verify Tool Description

What is a JSON Web Token (JWT)?

JWT Structure

Supported Algorithms

Signature Verification

Real-World Case Study: Mobile App Authentication

Real-World Case Study: Multi-Tenant SaaS Access

Example Calculation

Frequently Asked Questions

What is a JSON Web Token?

How do I use this tool?

What if the signature does not match?

How are expiration and issuance times validated?

Can I decode a JWT without verifying it?

What algorithms are supported?

Are there risks with using JWTs?

Can the payload be encrypted?

Why does my JWT show 'Invalid Signature' even though it's copied correctly?

Our Other Tools