JWT Decoder
Paste a JSON Web Token to see what's inside: the header, the payload and standard claims like who issued it and when it expires. For tokens signed with a shared secret, you can check the signature too.
How to decode a JWT
- 1Paste the token. “Bearer ” at the start is removed for you.
- 2Read the header, the payload and the expiry status.
- 3To verify an HMAC signature, enter the secret.
Claims in plain words
Times in iat (issued at), nbf (not before) and exp (expires) are shown as dates in your time zone, with how long ago or how soon. An expired token is flagged in red.
Signature check
Tokens signed with HS256, HS384 or HS512 use a shared secret. Enter it to confirm the token hasn't been changed. Tokens signed with RS256, ES256 or similar need the issuer's public key, which this tool doesn't check.
Private by design
Tokens can grant access to accounts. This decoder runs entirely in your browser, so your token and secret are never sent to a server, unlike many online debuggers.
Frequently asked questions
- Does decoding prove a token is genuine?
- No. Anyone can decode a JWT; only a valid signature shows it came from the issuer and wasn't changed.
- Can it read encrypted tokens (JWE)?
- No. Encrypted tokens can only be read with the decryption key.
- Is it safe to paste a production token?
- The token stays in your browser, but treat it like a password and don't paste it into tools you don't trust.