EnglishEN

JWT Decoder

Paste a JWT to see its contents and when it expires.

Your text and files never leave your browser — nothing is sent to a server.

Verify signature

Header
Payload
How to use
  1. Paste a JWT into the left box. An Authorization header value starting with “Bearer ” works too.
  2. On the right, review the header and payload JSON along with what each claim means. exp, iat and nbf are shown as dates plus relative times like “in 3 days”.
  3. For HS256, HS384 or HS512 tokens, enter the secret to check whether the signature is valid.
  4. Click “Insert example” to load a sample token together with its secret.
FAQ
Is it safe to paste my token here?
Tokens and secrets are decoded and verified only inside your browser — nothing is sent or stored anywhere. Even so, clear production tokens after checking them, and revoke any token that may have leaked.
If a token decodes, does that mean it is genuine?
No. The header and payload are only base64url encoded, so anyone can read them. Only a valid signature tells you the token is authentic.
Can I verify RS256 tokens?
This tool verifies HMAC tokens (HS256, HS384, HS512) that use a shared secret. RS256 and ES256 tokens can be decoded, but their signatures must be checked with the issuer’s public key.
Related tools
Base64 Encode/DecodeConvert text to and from Base64JSON FormatterBeautify, minify and validate JSONHash GeneratorMD5, SHA and CRC32 hashes at onceUnix TimestampEpoch time ↔ human-readable date
All tools