JWT Decoder
Decode a JSON Web Token and inspect its header, payload and expiry without sending it anywhere.
JSON Web Token
What a JSON Web Token contains
A JWT is three base64url segments separated by dots: header.payload.signature. The first two are ordinary JSON that anyone can read; the third is a signature over the first two.
That is the part people most often get wrong: a JWT is signed, not encrypted. Decoding one needs no key at all, so a token is not a place to store anything you would not put in a URL.
eyJhbGciOiJIUzI1NiJ9 . eyJpc3MiOiJodHRwcz . iA41sG-0EUDQ5SdECXga...
header payload signatureReading the standard claims
- iss — issuer: who created the token.
- sub — subject: who or what the token is about, usually a user id.
- aud — audience: the service the token is meant for. A service should reject tokens addressed elsewhere.
- exp — expiry, as a Unix timestamp in seconds. This tool converts it to your local time and flags expired tokens.
- nbf — not before: the token is invalid until this moment.
- iat — issued at: when the token was created.
- jti — a unique id for the token, used to revoke or de-duplicate it.
Verifying the signature
Decoding tells you what a token says. Verification tells you whether to believe it. Tick "Verify signature" and paste the shared secret to check an HMAC-signed token (HS256/384/512) right here.
For RS256, PS256 or ES256, use the JWT Signature Verifier, which takes a public key in PEM or JWK form.
Frequently asked questions
Is my token sent to your server?
No. The token is decoded in your browser with the built-in Web Crypto and TextDecoder APIs. No request is made, nothing is logged, and the page keeps working offline.
Can a JWT be decoded without the secret?
Yes, and that is by design. The header and payload are only base64url-encoded. The secret is needed to verify the signature, not to read the contents.
My token shows as expired but my app still accepts it. Why?
Most servers allow a small clock skew (commonly 30–60 seconds) when checking exp. If your device clock is ahead, a token can look expired here while still being accepted.
What does "alg: none" mean?
It declares a token with no signature at all. Any service that accepts it can be trivially forged, so a well-configured verifier rejects it outright.
Is it safe to paste a production token here?
Nothing leaves your browser, so the page itself poses no risk. Even so, treat a valid token like a password: anyone who obtains it can act as you until it expires.