A clear claims table; its share button uploads your token.
On this page
Scores
Updated
Out of 5, from what each tool does. The reasons are in the reviews below.
Tool
Privacy
Features
Price
Aarrange
5
4
5
jwt.io
5
3
5
token.dev
5
3
5
FusionAuth
5
2
5
jwt.ms
5
1
5
SuperTokens
4
1
5
jstoolset
3
1
5
What makes a good JWT decoder
Every JWT decoder can split a token at the dots and show the JSON inside. That part is easy. The differences show up when something is wrong with the token, and that is usually why you opened the decoder in the first place.
A good decoder answers the questions a server asks. Is the signature right for this key? Has the token expired, or is it not valid yet? What do claims like aud, scp or tid mean? When a token is broken, a good decoder says where and why, not just "invalid".
We tested each tool with the same tokens: a normal HS256 token that expired on 24 October 2025, a token with a broken payload, and a token with Bearer in front of it. The results were not what we expected. Only two of the seven tools said that the expired token had expired.
A live token is a password
Anyone who has a valid access token can use it until it expires. So the first question about a JWT decoder is the same as for a password field: where does the text go?
Good news: all seven decode in your browserWe watched the network in Chrome while we pasted a test token into each tool. None of them sent the token to a server while decoding. Two details still matter. SuperTokens sends usage analytics to its own API and to Amplitude when you paste; the token was not in those requests. And jstoolset has a Permanent Link button that uploads the token to its server and makes a short link to it.
Even with a tool that runs in your browser, the safest habit is to decode test tokens, not production ones. If you must look at a real token, use a tool you can check, and let the token expire or revoke it afterwards.
Detailed reviews
01
Aarrange
Catches expired tokens and points to the broken character; no encoder yet.
Decodes and verifies in your browser; nothing is uploaded and nothing goes in the URL
Warns about expired tokens, tokens that are not valid yet, tokens with no `exp`, and `alg: none`
Verifies HS, RS, PS, ES and EdDSA signatures with a secret, PEM, X.509 certificate, JWK or a whole JWKS (it picks the key by `kid`)
Marks the exact character where a broken token fails, with the reason and the fix
Explains each claim, including OpenID Connect and Microsoft Entra claims
Cons
No encoder: it cannot make or sign a new token
Smaller and newer than jwt.io
No dark mode
Aarrange's JWT Decoder is built around the question a server asks: would this token be accepted? Paste a token and the Claims view shows each claim with its meaning and every time as a date. A red note says when the token has expired or the signature does not match, and an amber note flags risks such as no exp, alg: none or a short HMAC secret.
It reads tokens the way people copy them, with Bearer , quotes or line breaks around them, and Clean token removes the rest. When a token is broken, it marks the character where decoding fails and says what to change, for example the quote that is missing in the payload.
To verify, paste the key in the Key tab: a shared secret for HS256, or for RS, PS, ES and EdDSA tokens a PEM block, an X.509 certificate, a JWK or the issuer's whole JWKS. It never fetches a key from a URL, and it decodes and verifies in your browser. You can watch the Network tab in DevTools to check that.
The gap is creating tokens. Aarrange has no encoder, so to make and sign a test token you need jwt.io, token.dev or a library.
02
jwt.io
The best known, with an encoder; it calls an expired token valid.
Generates example tokens for 22 algorithms, from HS256 to EdDSA (Ed25519) and post-quantum ML-DSA
Claims Breakdown shows times as dates and explains the registered claims
Verifies with a secret, or with a public key as PEM or JWK
Cons
Showed "Valid JWT" for our token that expired a year earlier
Error messages name the broken part but not the place
Run by Auth0, so the page also promotes Auth0 sign-up and an ebook
jwt.io is the name most developers know, and it is published by Auth0. The current debugger has a JWT Decoder tab and a JWT Encoder tab, a Claims Breakdown view that turns iat and exp into dates, and signature checks with a secret or a public key in PEM or JWK form. Its example generator covers 22 algorithms, including Ed25519 and the post-quantum ML-DSA family.
We pasted our test token and watched the network: no request carried the token. Decoding happens in your browser.
The weak spot is the verdict. Our test token expired on 24 October 2025, and jwt.io still showed "Valid JWT" on top. The Claims Breakdown shows the expiry date, but nothing says that the date has passed. A server would reject that token. When a token is broken, jwt.io says which part is wrong, but not where in it.
03
token.dev
Warns about expired tokens and does PASETO; weak on broken tokens.
Said "Jwt is expired" for our expired token, and shows times as "a year ago" with the date
Encodes and decodes, and also handles PASETO tokens
Says on the page that verification happens in the browser only
Cons
Algorithms stop at HS, RS and ES: no PS256 and no EdDSA
A broken token only gets "Jwt cannot be parsed", and the old payload stays on screen
Does not read a token with `Bearer ` in front
token.dev comes from Okta's developer team (the footer links to Okta's developer site). It is one of only two tools in this test that told us our expired token had expired: the status line read "Jwt is expired" and the claims showed "Expired: a year ago" with the date.
It encodes as well as decodes, and it has a second tab for PASETO, an alternative token format. The algorithm list covers HS256 to HS512, RS256 to RS512, ES256 to ES512 and none. There is no PS256 or EdDSA.
Broken input is where it falls short. Our token with a broken payload got "Jwt cannot be parsed", while the header and payload panes kept showing the previous token. A token with Bearer in front got the same message.
04
FusionAuth
Edit the payload and re-sign; no dates or expiry check.
Edit the header or payload and the token changes with it
Verifies with a secret, PEM or JWK
Tells you plainly not to paste production tokens
Cons
Shows `exp` and `iat` as raw numbers, with no dates and no expiry warning
No claim explanations
Showed non-ASCII text such as ë as wrong characters in our earlier test
FusionAuth's decoder lives in its documentation. It shows the token, the header and the payload in three editors, and the header and payload are editable: change a claim and the token is rebuilt, which makes it a quick way to make a test token. Signature checks take a secret, a PEM key or a JWK.
The page says the data never leaves the page, and our network check agreed. It also tells you not to paste production tokens, which is good advice for every tool here.
It does less to explain a token. Times stay as Unix numbers, there is no warning when a token has expired, and claims have no descriptions. In our tests a week earlier, it also showed the name "Zoë" as mojibake (wrongly decoded text).
05
jwt.ms
The best claim explanations; it cannot check a signature.
Explains every claim with a sentence and a link to the standard
Knows Microsoft Entra ID (Azure AD) claims
Says on the page that the token never leaves your browser
Cons
No signature check at all
No warning for an expired token
Showed nothing at all for our broken token
jwt.ms is a plain decoder with one strong feature: the Claims tab. Each claim gets a full sentence from the standard that defines it, with the section number, so exp comes with the RFC 7519 text and name with the OpenID Connect text. It also explains claims from Microsoft Entra ID (formerly Azure AD) tokens.
That is all it does. There is no field for a secret or a public key, so it cannot check a signature. It showed our expired token's exp as a date with no warning, and it showed a blank result for the broken token.
Says that all processing happens on the client side
Cons
Signature check is HMAC with a secret only
Sends usage analytics when you paste a token (the token was not in them)
No dates, no expiry warning and no error message for a broken token
SuperTokens, an open-source login provider, has a small encoder and decoder on its site. Paste a token and you see the header, the payload and the HMAC formula with a field for your secret.
It decodes in your browser, but it is not quiet: when we pasted our token, the page sent analytics events to SuperTokens' API and to Amplitude. We checked those requests and the token was not in them.
It shows exp as a raw number with no warning, and a week earlier it kept showing the previous payload when we pasted a broken token, with no error at all.
07
jstoolset
A clear claims table; its share button uploads your token.
Explanation table with each claim, its value and dates in ISO format
JSON tree of the decoded token
No ads
Cons
The Permanent Link button uploads the token to its server
No signature check
Error messages are vague, and blamed the wrong cause for a `Bearer ` prefix
jstoolset decodes the token in your browser and shows it twice: as a JSON tree and as an explanation table with each claim, its value, ISO dates for the times and a short meaning. It is easy to read.
Be careful with the Permanent Link button. When we pressed it, the page sent our test token to jstoolset.com/blob/set/ and changed the address to a short link to the saved token. That is handy for a test token and risky for a real one.
There is no signature check and no expiry warning. In our earlier test, a broken token got "Invalid JSON", and a token with Bearer in front got a message that blamed the header.
Search interest
How often people search Google for each tool by name, month by month over five years. It shows which names people know, not how many people use the tool.
50100020222023202420252026
Average search interest per tool, 0 to 100
Tool
5 years
Past year
jwt.io
47
40
jwt.ms
<1
<1
Aarrange
<1
<1
token.dev
<1
0
jstoolset
0
0
Source: Google Trends, worldwide web search, Oct 2021 to Oct 2026 (Oct 2026 is a part month). This is search interest, not visits: 100 is the busiest month of any name in this chart, and the table shows averages. Fetched 2026-10-31.
Full feature comparison
This table shows every feature we checked across all seven tools: full support, partial support, or no support.
Feature
Aarrange
jwt.io
token.dev
FusionAuth
jwt.ms
SuperTokens
jstoolset
Read the token
Decode header and payload
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Times as dates
Yes
Yes
Yes
No
Yes
No
Yes
Claim explanations
Yes
Yes
Partly
No
Yes
No
Yes
Check the token
Warns when the token has expired
Yes
No
Yes
No
No
No
No
Verify with a secret (HS256)
Yes
Yes
Yes
Yes
No
Yes
No
Verify with a public key (RS, ES)
Yes
Yes
Yes
Yes
No
No
No
Points to where a broken token fails
Yes
No
No
Partly
No
No
No
Make a token
Encode and sign a new token
No
Yes
Yes
Yes
No
Yes
No
Privacy and price
Decodes in your browser
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Token never sent to a server
Yes
Yes
Yes
Yes
Yes
Yes
Partly
Free, no sign-up
Yes
Yes
Yes
Yes
Yes
Yes
Yes
How we tested
We opened each tool in Chrome on 31 October 2026 and pasted the same HS256 test token. Its payload holds a name, a role, iat and an exp of 24 October 2025, so a correct tool should say that it has expired. We noted what each tool showed for the claims, the dates and the signature.
For privacy, we recorded every request each page made after the paste and searched them for the token. A tool that sent the token anywhere would have scored as server-side. We also pressed each share or link button we found and recorded what it sent.
For broken input, we used a token whose payload misses a closing quote and a token with Bearer in front, in this test and in a test of the same sites on 24 October 2026.
The features score counts five checks: signature checks with both secrets and public keys, an expiry warning, claim explanations, an encoder, and help that points to where a broken token fails. A partial check counts as half, and the total is rounded down. Privacy comes from where the token goes, and price from the pricing model. The order on this page follows the total of the three scores.
DisclosureAarrange is our own tool. We built the JWT Decoder after testing the sites on this list, so it was designed to fill the gaps we found, and that helps its score. We rated it by the same five checks as the others, including its main gap: it has no encoder. Open DevTools and check our claims for yourself.
Our verdict
To find out why a server rejects a token, use Aarrange. It says when a token has expired or is not valid yet, verifies every common algorithm with any key format, and points to the exact place where a broken token fails. It all runs in your browser. Try the JWT Decoder.
To make a test token, use jwt.io or token.dev. Both have an encoder, and token.dev also warns about expired tokens and handles PASETO. jwt.ms has the most detailed claim explanations, which helps with Microsoft Entra tokens.
Whatever you choose, decode test tokens when you can. All seven tools decode in your browser, but a share button can still put a token on someone else's server.
FAQ
Is it safe to paste a JWT into an online decoder?
Only if the decoder runs in your browser, and even then, prefer test tokens. A valid token works like a password until it expires. All seven tools in this test decoded in the browser, but jstoolset's Permanent Link button uploads the token to its server. You can check any tool yourself: open the Network tab in DevTools, paste a token and look for requests that contain it.
Does jwt.io send my token to a server?
Not when it decodes. We pasted a test token into jwt.io and no request carried it. The page does load Auth0's own scripts and a privacy-choices tool, so check the network yourself if you need to be sure.
Why does jwt.io say my expired token is valid?
In our test, jwt.io showed "Valid JWT" for a token that expired a year earlier. It checks the structure, and the expiry date is only shown in the Claims Breakdown. To see a warning, use a decoder that compares exp with the current time, such as Aarrange's JWT Decoder or token.dev.
Which JWT decoder can verify a signature with a JWKS?
Aarrange accepts the issuer's whole JWKS and picks the key whose kid matches the token. jwt.io and FusionAuth take a single key as PEM or JWK, so you copy the right key out of the JWKS first.
Can I create a JWT online?
Yes. jwt.io, token.dev and SuperTokens have encoders, and FusionAuth rebuilds the token when you edit the payload. Use a test secret or a test key pair, never a production key.
What is the difference between jwt.io and jwt.ms?
jwt.io decodes, verifies and encodes tokens, with many algorithms. jwt.ms only decodes, but explains every claim in detail, including Microsoft Entra ID claims. Neither one warned us that our test token had expired.
Aarrange
jwt.io
token.dev
FusionAuth
jwt.ms
SuperTokens
jstoolset
01
