JWT Decoder
Paste a JSON Web Token to read its header and payload, see when it expires and check the signature with your secret or public key.
INPUT
OUTPUT
The result appears here as you type.
Runs entirely in your browser. Nothing you enter is sent to a server.
How to decode a JWT
Paste the token
Copy the token from an Authorization header, a cookie or your browser's developer tools and paste it into the input.
Read the claims
The header and payload appear as formatted JSON. Dates such as exp and iat are shown in your own time zone.
Check the signature
Enter the shared secret (HS256) or the issuer's public key (RS256, ES256) to confirm the token hasn't been altered.
What is inside a JWT?
A JWT has three Base64URL-encoded parts separated by dots: a header that names the signing algorithm, a payload with claims such as the user ID and expiry time, and a signature. Anyone can read the header and payload; only the signature proves who issued the token.
Decoding is not verifying
Reading a token tells you what it claims, not whether those claims are true. Before your own code trusts a token, it should verify the signature and the exp claim on the server.
Frequently asked questions
Is it safe to paste my token here?
The token is decoded in your browser and is never sent to a server. Still, treat live tokens like passwords: anyone who has one can use it until it expires.
Which signing algorithms can be verified?
HS256, HS384 and HS512 with a shared secret, and RS256, PS256 and ES256, plus their 384 and 512 variants, with a PEM public key.
Why does it say my token has expired?
The exp claim is compared with your device's clock. If the time shown is in the past, servers will reject the token and you need a new one.
Can it decode encrypted tokens (JWE)?
No. Encrypted tokens have five parts and need the private key to read. This tool decodes signed tokens (JWS), which is what most APIs use.