JWT Decoder
Paste a JWT to read its header, payload and expiry in plain words, and check its signature with a secret or public key. The token never leaves your browser.
How to use it
- 1Paste the token, with or without “Bearer ” in front, or press Try a sample.
- 2Read the header and payload, and below them what each claim means, with times shown in your own time zone.
- 3To check the signature, type the secret (HS256) or paste the public key (RS256, ES256 and others), then press Verify signature.
Frequently asked questions
Is it safe to paste my JWT here?
Yes. The token is decoded and checked by your own browser: nothing you paste, including secrets and keys, is sent anywhere, saved or recorded. Still, treat a live token like a password, and use an expired or test token when you can.
Can a JWT be decoded without the secret?
Yes. The header and payload are only Base64URL encoded, not encrypted, so anyone who has the token can read them. The secret or key is needed only to check the signature, which proves the token is genuine and unchanged. So never put passwords or private data in a JWT.
How do I check when a JWT expires?
Look at its exp claim: a number of seconds since 1 January 1970, UTC. This page shows it as a date and time in your time zone, says how long is left or how long ago it expired, and warns when a token has expired or isn't valid yet.
Which signing algorithms can be verified?
HS256, HS384 and HS512 with the shared secret; RS256, RS384, RS512, PS256, PS384 and PS512 with an RSA public key; ES256, ES384 and ES512 with an EC public key; and EdDSA (Ed25519) in browsers that support it. Paste the key as PEM, as a certificate, or as a JWK or JWK set. Tokens of up to 100,000 characters can be read.
Why does it say my token is encrypted?
A token with five parts instead of three is a JWE: its contents are encrypted, so only the service holding the right key can read them. Its header is shown, but its claims can't be read here.
Related tools
- JSON Formatter and ValidatorFormat, minify and validate JSON, with any mistake shown by its line and column.
- Base64 Decode and EncodeDecode or encode Base64 text and files, with Hindi and emoji kept intact.
- Regex TesterTest JavaScript regular expressions live, with every match and group highlighted.
- UUID GeneratorMake random v4 or time-ordered v7 UUIDs, one or thousands at once, and check any UUID.