JWT Decoder
Paste a JWT to see what is inside it: the header, the payload, the standard claims with readable dates, and whether it has expired. The token is decoded in your browser and is never sent to a server.
Decoded in your browser. The token is never sent anywhere, but treat live tokens as passwords and do not share them.
How to use it
- Paste the token (three parts separated by dots) into the box. A leading “Bearer ” is ignored.
- Read the header (algorithm, token type) and the payload (the claims). Dates such as exp, iat and nbf are shown in your local time.
- For tokens signed with HS256, HS384 or HS512, type the secret and press “Check signature” to see whether it matches.
Frequently asked questions
Is it safe to paste my token here?
The token is decoded locally with JavaScript and is not uploaded. Even so, a live token works like a password until it expires, so avoid pasting production tokens into any website you do not trust, and never share them.
Does decoding a JWT prove that it is valid?
No. Anyone can read the header and payload of a JWT because they are only base64url-encoded, not encrypted. A token is trustworthy only if its signature checks out against the right key and its claims (expiry, issuer, audience) are acceptable.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds.
Why can I only check some signatures?
HS256, HS384 and HS512 use a shared secret, so you can check them by typing the secret. RS256, ES256 and similar algorithms need the issuer’s public key, which this tool does not ask for.
What is a token with five parts?
That is an encrypted token (JWE). Its payload is encrypted, so it cannot be read without the decryption key.
Related tools
These tools run entirely in your browser and are provided free, without warranty. Check important results before using them in production.