JWT Decoder
Paste a JSON Web Token to see its header, payload and claims decoded, check whether it has expired, and verify HMAC signatures with your secret.
Signature verification
How to decode a JWT
- Paste your JSON Web Token into the box, or click Load example to try it.
- The header, payload and standard claims are decoded instantly, with expiry shown in plain language.
- To check the signature, enter the shared secret for HS256, HS384 or HS512 tokens.
Features
Instant decode
Header, payload and claims as formatted JSON.
Human-readable dates
exp, nbf and iat converted, with an expired/valid badge.
HMAC verification
Check HS256/384/512 signatures with your secret.
Private
Everything runs in your browser; nothing you paste is uploaded.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, URL-safe way to represent claims between two parties. It has three Base64URL parts separated by dots: a header describing the algorithm, a payload of claims such as the user and expiry, and a signature.
Is it safe to paste my token here?
Decoding happens entirely in your browser and the token is never sent anywhere. Even so, treat real production tokens as secrets and prefer test tokens when you can.
Does decoding a JWT prove it is valid?
No. Anyone can decode a JWT because the payload is only encoded, not encrypted. Only signature verification with the correct key proves the token was issued by a trusted party and not altered.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the earliest time it is valid. All are Unix timestamps in seconds, which this tool converts to dates.