Paste a JSON Web Token to read its header and payload, see every claim explained in plain English, and check whether it has expired. Optionally verify an HMAC signature. Nothing is sent anywhere.
🔒 This tool runs entirely in your browser. Nothing you enter or upload is sent to our servers.
How to use the JWT Decoder
- Paste the token. Decoding starts as you type — the three dot-separated parts are split and base64url-decoded.
- Read the header and payload. Registered claims are explained, and exp, iat and nbf are shown as real dates with an expiry verdict.
- To check the signature on an HMAC token, enter the shared secret. HS256, HS384 and HS512 are supported.
About this tool
A JSON Web Token is three base64url-encoded parts joined by dots: a header naming the algorithm, a payload of claims, and a signature over the first two. The first two parts are encoded, not encrypted — anyone holding the token can read them, which is exactly what this page does. That is worth remembering when deciding what to put in a payload.
Pasting a token into a web page is a real risk if that page sends it anywhere: a live token is a credential, and tokens are routinely pasted out of production logs. This decoder does all its work in the page with no network calls at all, which you can confirm in your browser’s Network tab — after the page loads, decoding a token produces no requests.
Signature verification uses the Web Crypto API built into your browser. Only HMAC algorithms are offered, because those are the ones where a single shared secret is enough. RS256 and ES256 verification needs the issuer’s public key in JWK or PEM form and a matching curve or modulus, which belongs in a library rather than a text box. A decoded token with an unverified signature still tells you what a service believes about a request, which is usually what you are debugging.
Frequently asked questions
Is a JWT encrypted?
No. The header and payload are base64url-encoded, which is reversible by anyone. The signature proves the token has not been altered and was issued by someone holding the key — it does not hide the contents. Never put a secret in a JWT payload.
Is it safe to paste a real token here?
This page makes no network requests while decoding, so the token stays in your browser. It is still good practice to treat any live token as a password and revoke one that has been pasted into a tool you do not control.
Why does it say my token is expired?
The exp claim is a Unix timestamp in seconds. If it is earlier than your computer’s clock, the token is past its expiry. A token that looks wrongly expired is often a clock-skew problem on the machine, or seconds being confused with milliseconds.
Can it verify RS256 tokens?
No — only HS256, HS384 and HS512. RSA and ECDSA verification needs the issuer’s public key, which is a different workflow. The decoded header and payload are shown for every algorithm regardless.
What do iat, nbf and exp mean?
iat is when the token was issued, nbf the earliest moment it is valid (“not before”), and exp when it stops being valid. All three are Unix timestamps in seconds, and all three are shown here as readable dates.
My token will not decode. Why?
A JWT has exactly three parts separated by dots. Copying from a log often drags in a trailing quote, a newline or the word Bearer. Whitespace is stripped here, but stray punctuation still breaks base64url decoding.