JWT Decoder
Paste a JSON Web Token to read its header and payload, see when it expires, and check its signature with a secret or public key.
Tokens and keys stay in your browser. Nothing is sent or logged.
Related Developer Tools
This JWT decoder reads a JSON Web Token and shows what is inside it: the header with the signing algorithm, the payload with its claims, and when the token was issued and expires, in plain dates. It can also verify the signature, with a shared secret for HMAC tokens or a public key for RSA, ECDSA and EdDSA tokens, which is how you tell a genuine token from an edited one. Decoding and checking both happen in your browser.
The Three Parts of a JWT
A signed JWT is three Base64URL strings joined by dots, coloured the same way in the tool:
- Header: which algorithm signed the token (
alg), usually the type (typ), and often a key ID (kid) that says which of the issuer's keys to check it with. - Payload: the claims, which are statements about the user and the token itself.
- Signature: computed over the first two parts with the issuer's key. It does not hide anything; it proves nothing was changed.
The format is defined in RFC 7519, the signing in RFC 7515 and the algorithm names in RFC 7518.
Registered Claims
| Claim | Name | What a server checks |
|---|---|---|
iss | Issuer | It matches the identity provider it trusts |
sub | Subject | Which user or client the token is for |
aud | Audience | Its own identifier is listed, so a token for another API is refused |
exp | Expiration time | The current time is before it |
nbf | Not before | The current time is at or after it |
iat | Issued at | Optional: how old the token is |
jti | JWT ID | Optional: that the token has not been used before |
Supported Signature Algorithms
- HS256, HS384, HS512 (HMAC): one shared secret signs and verifies. RFC 7518 requires a secret at least as long as the hash, so 32 random bytes or more for HS256.
- RS256, RS384, RS512 (RSA) and PS256, PS384, PS512 (RSA-PSS): the issuer signs with a private key and anyone can verify with the public key.
- ES256, ES384, ES512 (ECDSA on the P-256, P-384 and P-521 curves): shorter keys and signatures than RSA.
- EdDSA (Ed25519): checked when your browser's Web Crypto supports it, which current versions of the major browsers do.
Mistakes This Page Helps You Catch
A token with "alg": "none" carries no signature, and accepting it lets anyone write their own; the tool flags it. A token that decodes fine but fails verification has been changed or was signed with a different key. An expired token, or one whose nbf is in the future, explains many "401 Unauthorized" errors; compare the times shown with your server's clock, since a few minutes of clock difference is enough. And because anyone can read a payload, finding an email address or internal ID there is expected, but finding a password is a bug.
Related Tools
A JWT's parts are Base64URL; to decode other Base64 strings, use the Base64 encoder and decoder. To tidy a JSON payload, use the JSON formatter, and to get TypeScript types for it, JSON to TypeScript.
Frequently Asked Questions
How do I decode a JWT?
Paste the token into the box. The header and payload are shown as formatted JSON straight away, with a banner saying whether the token has expired. You can paste the whole Authorization header value; the word Bearer is removed for you.
Is it safe to paste a token here?
The token is decoded by JavaScript in your browser and is never sent anywhere or stored. Even so, a live access token lets anyone who has it act as you until it expires, so treat it like a password: prefer test or expired tokens, and do not paste production tokens into tools you have not checked.
Is the payload of a JWT encrypted?
No. In an ordinary signed JWT the header and payload are only Base64URL-encoded, so anyone holding the token can read them, as this page shows. Never put passwords or other secrets in a payload. Encrypted tokens (JWE) have five parts instead of three, and their payload can only be read with the recipient's key.
How do I verify the signature?
For HS256, HS384 and HS512, enter the shared secret the token was signed with. For RS, PS, ES and EdDSA algorithms, paste the issuer's public key as PEM, as a JWK, or as a whole JWKS from the issuer's jwks.json URL, in which case the key with the token's kid is used. The check uses your browser's built-in Web Crypto.
What do exp, iat and nbf mean?
They are times in seconds since 1 January 1970 UTC. exp is when the token stops being valid, iat is when it was issued, and nbf is the earliest time it may be used. The claims table shows each one as a date in your time zone and in UTC.
Why does a valid-looking token fail verification?
Usually the key is wrong: a different environment's secret, an old public key after the issuer rotated keys, or a secret that is Base64-encoded but was entered as text (switch on Secret is Base64 encoded). Any change to the header or payload also breaks the signature, which is the point of it.
Does a decoded token mean it is valid?
No. Decoding only reads the contents, which anyone can forge. A server must check the signature with the right key, reject alg none, and check exp, nbf, iss and aud before trusting a token.