JWT decoder
Decode a JSON Web Token into its header, payload and claims, see whether it is expired, and optionally verify an HS256, HS384 or HS512 signature.
Three base64url parts separated by dots: header.payload.signature.
Decoded token
Header
Payload
| Claim | Value | Meaning |
|---|
Signature
Decoding does not check the signature. Enter the secret used to sign this token to verify it here, entirely in your browser.
How it works
This tool is a client-side JWT decoder that splits a token into its header, payload and signature parts, base64url-decodes the header and payload, and displays registered claims such as exp, iat and sub with human-readable timestamps and an expired-or-valid badge based on the current time.
- Paste the token
The three-part dot-separated string.
- Read the claims
Standard claims are labeled, with timestamps converted to a readable date.
- Verify the signature, optionally
For HS256, HS384 or HS512 tokens, paste the secret to check it.
Decoding is not verifying
A JWT has three parts joined by dots: a header describing the signing algorithm, a payload of claims, and a signature. The header and payload are only base64url-encoded, not encrypted, so anyone can decode and read them without a key, which is exactly what this tool does. The signature is what actually proves the token was issued by whoever holds the secret or private key, and checking it is a separate operation from decoding.
- Registered claims: exp (expiration), iat (issued at), nbf (not before), sub (subject), iss (issuer), aud (audience) and jti (token ID) are recognized and labeled; exp, iat and nbf are also shown as a readable date.
- Expired check: compares the exp claim, if present, to your device's current time.
- Signature verification: for HS256, HS384 and HS512 tokens, entering the shared secret recomputes the HMAC in your browser using the Web Crypto API and compares it to the token's signature. RS256, ES256 and other public-key algorithms need the issuer's public key rather than a shared secret, which this tool does not accept, so it reports the algorithm as unsupported for verification here.
Do not trust a decoded token you have not verified
Anyone can construct a JWT with any claims and an invalid signature, since decoding never checks it. Never make an authorization decision from a decoded payload alone; verify the signature first, normally on your server with the same library that issued the token. Everything on this page runs in your browser: the token, and any secret you enter to verify it, is never sent anywhere.
Frequently asked questions
How do I decode a JWT token to see its payload?
Paste the full JWT, the three-part dot-separated string, into the input field. The tool splits it at the dots, base64url-decodes the header and payload segments, and renders each claim in a structured table. Standard claims such as exp (expiration), iat (issued at), and sub (subject) are labeled and converted to readable dates.
Does decoding a JWT verify its signature?
No, decoding and verifying are two distinct operations. Decoding reads the header and payload without checking the cryptographic signature. A decoded JWT that looks valid can still be forged. This tool can additionally verify an HS256, HS384 or HS512 signature if you provide the shared secret, but RS256, ES256 and other public-key algorithms still need to be verified on your server, where the private key's matching public key is available.
Is it safe to paste a production JWT into this decoder?
The decoder runs entirely in your browser; the token, and any secret you enter to verify it, is never sent to any server. As a best practice, avoid pasting live tokens that grant sensitive access anywhere. If you need to debug a production token, use a test copy or a token with a short expiration window.
How can I tell if a JWT is expired using this tool?
After decoding, look for the exp claim in the payload section. The tool converts the Unix timestamp to a human-readable date and shows an expired or valid badge based on your device's current time. If the current time is past the exp value, the token is expired and will be rejected by any properly implemented server.
What JWT algorithms does this decoder support?
Decoding works with a token signed using any algorithm, HS256, RS256, ES256, and so on, because reading the header and payload only involves base64url decoding, which is algorithm-agnostic. Signature verification in this tool is limited to the symmetric HS256, HS384 and HS512 algorithms; RS and ES tokens report as unsupported for verification here since they need a public key rather than a shared secret.