JWT Decoder
Decode JSON Web Tokens, inspect header and payload claims, check expiry and verify signatures — privately.
Header
Payload
Claims
| Claim | Value | Meaning |
|---|
Verify signature
Decoding does not prove a token is genuine. Enter the secret or public key to verify the signature locally in your browser.
100% private: everything runs in your browser and nothing is uploaded.
How to Decode a JWT
No sign-up, no installation — it works right here in your browser.
- Step 1:Paste the token into the input box (a leading Bearer prefix is removed automatically) or click Load sample.
- Step 2:Read the decoded header and payload, the claims table and the expiry status badges.
- Step 3:Optionally enter the HMAC secret or PEM public key and click Verify signature to confirm the token is authentic.
JWT Decoder FAQ
Is it safe to paste a JWT into an online decoder?
With this tool, yes: decoding and verification run entirely in your browser and the token is never uploaded. Still, treat production tokens like passwords and avoid sharing them in tickets, chats or screenshots.
Does decoding a JWT verify it?
No. Anyone can decode a JWT because the header and payload are only Base64URL-encoded, not encrypted. Only signature verification with the correct secret or public key proves the token is genuine and unmodified.
How do I check if a JWT is expired?
Look at the exp claim, a Unix timestamp in seconds. The decoder converts it to your local date and time and shows an Expired or Not expired badge, along with nbf (not before) and iat (issued at).
Which signing algorithms can be verified?
HS256, HS384 and HS512 with a shared secret, and RS256/384/512, PS256/384/512 and ES256/384/512 with a PEM-encoded public key, using the browser's built-in Web Crypto API.
What is the difference between JWS and JWE?
A JWS (three parts) is signed: its contents are readable but tamper-proof. A JWE (five parts) is encrypted, so its payload cannot be read without the decryption key. This tool decodes JWS tokens, the kind used for most access and ID tokens.
What Is a JWT and How Do You Decode It?
A JSON Web Token (JWT) is a compact, URL-safe string used by OAuth 2.0, OpenID Connect and most modern APIs to carry identity and authorisation data. It has three Base64URL-encoded parts separated by dots: a header that names the signing algorithm, a payload with claims such as sub, iss, aud, iat and exp, and a signature that proves the token has not been tampered with. Decoding a JWT simply means Base64URL-decoding the first two parts so you can read the JSON inside — which is exactly what you need when debugging login flows, API gateways, expired sessions or permission problems.
This free JWT decoder shows the header and payload as formatted JSON, explains every standard claim, converts timestamps such as exp, nbf and iat into readable local dates and tells you at a glance whether the token is valid, expired or not yet active. It also flags insecure alg none tokens and can verify the signature with an HMAC secret (HS256, HS384, HS512) or a PEM public key (RS256, PS256, ES256 and stronger variants) using the browser's Web Crypto API. Tokens are processed entirely on your device — they are never sent to our servers — so you can safely inspect real access tokens and ID tokens.