JWT decoder

Paste a JWT to see its header and payload, when it expires - and whether the signature matches your secret.

Token

Header

Payload

Verify the signature

Secret (HS256, HS384, HS512)

Everything happens in your browser - nothing you type here is sent to any server.

How it works

What a JWT is made of

A JWT is three parts separated by dots: a header (the signing algorithm), a payload (e.g. the user ID, roles, dates) and a signature. The header and payload are only Base64URL-encoded - anyone can read them. The signature guarantees nobody changed them.

Dates in a token

iat is when the token was issued, nbf when it becomes valid, exp when it expires. They're Unix timestamps (seconds since 1970); the decoder shows them as dates and tells you whether the token is valid right now.

Frequently asked questions

Is it safe to paste a token here?

The token is decoded in your browser and never sent to a server. Still, avoid pasting production tokens anywhere you don't have to - whoever has a valid token can use it.

Is a JWT encrypted?

No - a standard JWT is only signed. Don't put passwords or data the user shouldn't see in it.

Why can't I verify an RS256 signature?

RS256 and ES256 are signed with a private key and verified with a public one (e.g. from your login provider's JWKS URL). This tool verifies HMAC signatures based on a shared secret.