JWT decoder●
Paste a JWT to read its header, payload and expiry. Check the signature with a secret or a public key.
Decoding happens as you paste. The token never leaves this page.
Result
Header
Payload
Claims
Your token is decoded on your device. Nothing is uploaded, logged or stored. Even so, avoid pasting tokens that are still live for sensitive systems.
What is inside a JWT
A JSON Web Token is three Base64URL parts joined by dots: a header that names the algorithm, a payload of claims such as who it is for and when it expires, and a signature. Anyone can read the first two parts, so never put secrets in a JWT. Only the signature, checked with the right key, shows the token has not been changed.
Base64 converter →Common questions
Is my token uploaded anywhere?
No. It is decoded in your browser and never sent to a server. The signature check uses your browser's built-in crypto, also on your device.
Does decoding prove a token is genuine?
No. Anyone can write a payload and encode it. Only a valid signature, checked with the correct secret or public key, shows the token was issued by the key holder and not changed. Your server must still check the issuer, audience and expiry.
Which signature algorithms can I check?
HS256, HS384 and HS512 with a shared secret, and RS, PS and ES (256, 384 and 512) with a public key in PEM or JWK form. Tokens with alg none are not signed, so there is nothing to check.
Why does it say my token is expired?
The exp claim is a time in seconds since 1970. If it is before the current time on your device, the token is expired. A wrong device clock can also cause this. The nbf claim is the earliest time the token is valid.
Is it safe to paste my secret here?
The secret stays in this tab and is not sent anywhere. Still, treat real production secrets with care: use a test secret when you can, and clear the page when you are done.