All tools

JWT Decoder

Encoders

Decode a JSON Web Token, see at a glance whether it has expired, and verify its signature. Your token never leaves your browser.

  • JWT
  • Runs offline
  • Security
HeaderPayloadSignature
Decoded
Paste a token
Header
Payload
Claims
Claims appear here once a token is decoded.
Verify signature
Algorithm —
Decode a token first.
What a JWT is
A JSON Web Token is a compact, signed piece of JSON that a server hands out after login and expects back on every request, usually in an Authorization: Bearer … header. It is three Base64url strings joined by dots:
  • HeaderWhich algorithm signed the token, e.g. {"alg": "HS256"}.
  • PayloadThe claims: who the user is, who issued the token, when it expires.
  • SignatureProof the server issued it and nobody changed a byte since.
A JWT is signed, not encrypted. Anyone holding the token can read the payload — which is exactly what this decoder does without any key. The signature only stops people from changing it.
How to use the JWT decoder
  1. Paste the token into Encoded token. A leading Bearer  is removed for you.
  2. Read the status: Valid, Expired or Not Yet Valid, with the exact time in your time zone and in UTC.
  3. Check the Claims table — every standard claim is explained in one line.
  4. To check the signature, enter the shared secret (HS256, HS384, HS512) or the public key (RS256, ES256) and press Verify Signature.
  5. Copy the header or payload as formatted JSON.
Examples
Check when a token expires
The status counts down live, and exp is shown as a date, not a number of seconds.
Find out why a request returns 401
An expired token is the most common reason. The status says when it expired.
Catch an unsigned token
alg: none means nobody signed it. A server must never accept one.
Verify an RS256 signature
Paste the issuer's public key — never the private one — and check the token was really signed by it.
Frequently asked questions
Can a JWT be decoded without the secret?
Yes. The header and payload are only Base64url-encoded, so anyone with the token can read them. The secret or key is needed only to check the signature. That is why a JWT must never carry passwords or other secrets.
Is it safe to paste my token here?
The token is decoded in your browser and never sent anywhere — you can confirm it in the Network tab of your developer tools. Still, treat a live production token like a password: anyone who gets it can act as you until it expires.
What does "Not Yet Valid" mean?
The token has an nbf (not before) claim in the future. Servers reject it until that moment. If it happens right after login, the clocks of the server that issued the token and the one checking it are probably out of sync.
Why can't my token be decoded?
A token with five parts is encrypted (JWE) and can be read only with the recipient's key. A token with no dots at all is an opaque token: a random reference that only the server that issued it can look up.
Which signatures can this page verify?
HS256, HS384 and HS512 with a shared secret, and RS256 and ES256 with a public key in PEM or JWK form. Verification uses your browser's built-in Web Crypto.
Related tools
Unix Timestamp ConverterTurn exp and iat values into dates in any time zone.Encoder / DecoderBase64, Base64url, URL and HTML encoding, both ways.JSON Formatter & ValidatorFormat, validate, unescape and repair JSON.
Learn more
Testing in PracticeTesting an HTTP APIStatus codes, headers, schemas and error bodies, including the authorisation cases everyone forgets.Kubernetes FoundationsConfigMaps and SecretsWhy Base64 is an encoding, not encryption — the same reason anyone can read a JWT.