JWT Decoder & Verifier
Paste a JSON Web Token to read its header and claims, see when it was issued and when it expires, and optionally verify an HMAC signature with your secret. Decoding happens entirely in your browser.
Free · No sign-up · Files stay on your device
How to use JWT Decoder
- 1Paste the JWT.
- 2Read the decoded header, payload and time claims.
- 3Optionally enter the secret to verify an HS256/384/512 signature.
Features
- Header and payload as formatted JSON
- exp, iat and nbf shown as dates, with expiry status
- HS256, HS384 and HS512 signature verification
- Clear errors for malformed tokens
- Token and secret never leave your browser
What is inside a JWT?
A JWT has three Base64URL parts separated by dots: a header (algorithm and type), a payload (claims such as user ID, roles and expiry) and a signature. The header and payload are only encoded, not encrypted, so anyone holding the token can read them.
Why decode locally?
A JWT is often a live login credential. Pasting it into a website that sends it to a server can expose your account. This decoder never sends the token or secret anywhere.
Frequently asked questions
Can this decode encrypted tokens (JWE)?
No. JWE tokens have five parts and are encrypted. This tool decodes signed tokens (JWS), the common kind.
Can it verify RS256 tokens?
Not yet. HMAC algorithms (HS256/384/512) can be verified with a shared secret; RS256 needs the issuer's public key.
Is it safe to paste production tokens?
The token stays on your device. Still, treat tokens like passwords and avoid sharing screenshots of them.