What is the JWT Decoder?#
The JWT Decoder turns a JSON Web Token into readable parts without sending it anywhere. Paste a token and it is split into header, payload, and signature as you type.
The header and payload are decoded from base64url into formatted JSON. Registered claims such as exp, iat, and iss are collected in a table with local time, UTC time, and Unix timestamps, and the expiration state is shown at a glance. HMAC signatures can be checked against a secret inside your browser.
How to Use#
- Paste the JWT into the input. A
Bearerprefix, anAuthorization:header, a pair of surrounding quotes, and line breaks are removed automatically. - Read the decoded header and payload.
- Check the claims table for expiration and other times.
- For HS256, HS384, or HS512 tokens, paste the secret to verify the signature.
What You Can Check#
- Header and payload: the decoded JSON, including private claims that are not registered.
- Registered claims: iss, sub, aud, exp, nbf, iat, and jti. Time claims show local time, UTC time, and the raw Unix value, and every value can be copied individually.
- Expiration: whether the token is valid, expired, or not valid yet, along with the remaining or elapsed time.
- Sizes: the character and byte count of the token and of each decoded part.
Verifying the Signature#
HMAC signature verification is supported: HS256, HS384, and HS512. Paste the secret and the result appears automatically. The check runs in your browser, and the secret you enter is never sent or saved.
Tokens signed with other algorithms, such as RS or ES, can still be decoded, but their signatures cannot be verified.
Decoding only shows what a token claims. Anyone can build a token with any payload, so a readable token is not a trusted one. Compare the signature against the secret, or verify it on your server, before relying on the claims.
Common Use Cases#
- Trace a 401 or 403 response: check whether the token has expired or the aud and iss values do not match the API.
- Read the claims a frontend library has stored before debugging an authentication flow.
- Before changing how your service signs tokens, check the alg value and other header fields.
Frequently Asked Questions#
No. Everything runs in your browser, and neither the token nor the secret is uploaded or stored.
Yes. Paste the token and the header and payload are decoded. The secret is used only to verify an HMAC signature.
No. This tool handles HMAC signatures only. Tokens that use other algorithms are still decoded, and the claims, expiration, and sizes can be checked as usual.
The secret may not match the one used to sign the token, or the token may be damaged or changed. Check that the alg value in the header matches the secret, then try again.
The expiration check uses the clock on your device. If the clock is off, or the server allows a small amount of clock skew, the result can differ from what your app does.
exp is the time the token stops being valid, iat is when it was issued, and nbf is the earliest time it can be used. All three are Unix timestamps in seconds.
Notes#
- base64url is an encoding, not encryption. The header and payload can be read by anyone who has the token.
- Only JWS tokens with three parts are supported. Encrypted tokens (JWE) with five parts are not decoded.