JWT decoder
Paste a JSON Web Token to read its header and payload, see when it was issued and when it expires, and check an HS256 signature. Everything happens in your browser.
- 100% free
- Runs in your browser
- No uploads
Decoded token
The header, payload and the issued, not-before and expiry times appear here. Decoding doesn't check the signature; add the secret on the left to do that for HS256 tokens.
- Runs on your deviceEvery tool works directly in your browser. No files are uploaded.
- Your privacy mattersYour files never leave your device, so there's nothing for us to store.
- No limitsUse any tool as much as you need. No daily caps, no waiting.
- Completely freeNo signup and no trial to cancel. Ads keep the tools free.
How to decode a JWT
- Paste the token. It starts with eyJ. A full Authorization header value with Bearer in front works too.
- Read the result. The header and payload are shown as formatted JSON, with exp, iat and nbf turned into dates in your time zone and UTC.
- Check the expiry. The status line says whether the token has expired or isn't valid yet, and by how long.
- Verify, if you have the secret. For HS256, HS384 or HS512 tokens, type the secret to see whether the signature matches.
What's inside a JWT
A signed JWT has three parts separated by dots: header.payload.signature. The header and payload are JSON, each encoded with Base64url (the URL-safe Base64 alphabet without padding). The signature is computed over the exact text header.payload, so changing a single character of either part makes it fail.
For HS256 the signature is HMAC-SHA256(secret, header + "." + payload), Base64url-encoded. A token with five parts is an encrypted JWE instead: its payload can't be read without the decryption key.
Registered claims
| Claim | Meaning | Example |
|---|---|---|
iss | Issuer: who created the token | https://auth.example.com |
sub | Subject: usually the user id | user_123 |
aud | Audience: the API the token is for | api.example.com |
exp | Expiry time, seconds since 1970 | 1700003600 (14 Nov 2023, 23:13:20 UTC) |
nbf | Not valid before this time | 1700000000 |
iat | Issued at | 1700000000 (14 Nov 2023, 22:13:20 UTC) |
jti | Unique token id, used to block reuse | 9f1c… |
Common JWT mistakes
- Putting secrets in the payload. Anyone holding the token can read it. Keep only ids and permissions there.
- Accepting alg "none". An unsigned token can be forged by anyone. Servers should accept only the algorithm they expect.
- Weak HS256 secrets. A short or dictionary secret can be guessed offline from one token. Use at least 32 random bytes.
- Clock skew. Servers whose clocks differ by a minute can reject fresh tokens; most libraries allow a small leeway. Convert any time with the Unix timestamp converter.
Frequently asked questions
Is it safe to paste a real token here?
The token is decoded by JavaScript on this page and is never sent anywhere, so it doesn't leave your device. Even so, a live token is a password for as long as it's valid: avoid pasting production tokens into any website you don't control, and prefer expired or test tokens when you only need to read the claims.
Does decoding a JWT verify it?
No. The header and payload are only Base64url-encoded, so anyone can read them without a key. Whether the token is genuine depends on the signature. Decoding shows what the token claims; only checking the signature with the right key shows the claims weren't changed.
How do I verify an HS256 signature?
Paste the token, then type the shared secret in the box. The tool recomputes the HMAC-SHA256 of the header and payload with your browser's Web Crypto and compares it with the signature. HS384 and HS512 work the same way. Tick the Base64 box if your secret is stored Base64-encoded.
Can it verify RS256 or ES256 tokens?
Not yet. Those are signed with a private key and checked with a public key (often published at a JWKS URL). This tool decodes them fully but only checks HMAC signatures, so it never needs to fetch anything.
Why does my token say it expired in 1970 or in the far future?
JWT times (exp, iat, nbf) are seconds since 1 January 1970 UTC. A value in milliseconds is 1,000 times too big and lands tens of thousands of years ahead; the tool warns when it sees one. A very small number usually means the time was set in minutes or left as 0.