JWT Decoder

About the JWT Decoder

A JSON Web Token (RFC 7519) is three base64url-encoded parts joined by dots: a header, a payload of claims, and a signature. This decoder pretty-prints the header and payload and lists each claim with its meaning. Time claims such as exp and iat are shown as UTC dates, and the token is flagged as expired, not yet valid, or missing an expiry.

Everything runs in your browser. For HS256, HS384 and HS512 tokens you can enter the shared secret to check the signature with the Web Crypto API. A token with alg: none is flagged because it has no signature.

How to use it

1. Paste a token into the input. A leading Bearer prefix is stripped for you.
2. Read the decoded header, payload and claims.
3. For an HMAC token, type the secret under "Verify signature" to see whether it matches.

Examples

• Decode the classic jwt.io sample: verifies with the secret your-256-bit-secret.
• Decode an expired token: the exp claim is in 2018, so it is marked expired.
• Inspect an unsigned token: uses alg: none and is flagged for rejection.

Common questions

Is it safe to paste a JWT here?

The token is decoded locally and never sent to the server. Still, treat live tokens like passwords and prefer test tokens.

Does decoding a JWT prove it is valid?

No. Anyone can create a token with any claims. Only a signature check with the correct key, plus checks on exp, nbf, iss and aud, tells you whether to trust it.

Is the payload encrypted?

No. A signed JWT is only encoded, so anyone holding it can read the claims.

Why can't I verify an RS256 token?

RS256 and ES256 use public-key signatures; this tool only verifies HMAC algorithms (HS256/384/512).

Related tools

• Base64 & URL Encoder / Decoder: decode a single base64url segment by hand.
• Unix Timestamp Converter: convert exp or iat values to dates.
• JSON Formatter & Validator: format or validate a claims object before encoding it.