JWT Decoder
Paste a JWT and read its header and payload instantly, with issued-at and expiry times translated to real dates (and an expired warning when relevant). Optionally paste the secret to verify HS256 signatures — all locally, so tokens and secrets never leave your browser.
How to use
- Paste the token — decoding happens as you type.
- Read the header (algorithm, type) and payload (claims) as formatted JSON.
- Check the time line: iat, nbf and exp are shown as dates, with an EXPIRED flag when past.
- Optional: paste the signing secret to verify an HS256 signature locally.
Supported formats
- Standard three-part JWTs (header.payload.signature, base64url-encoded JSON).
- Signature verification: HS256 (HMAC-SHA-256) via the browser's Web Crypto API.
Privacy
This tool runs entirely in your browser. Nothing you enter or open is sent anywhere. Privacy policy.
Limitations
- RS256/ES256 and other asymmetric signatures are decoded but not verified — only HS256 verification is supported.
- Decoding a token never proves it is trustworthy; only signature verification does.
FAQ
Is it safe to paste a real JWT here?
The token is decoded entirely in your browser with no network calls — nothing is transmitted. Still, treat production tokens like passwords: prefer expired or test tokens when debugging in shared environments.
Why does my token show EXPIRED?
The exp claim is a Unix timestamp; when it is earlier than now, servers will reject the token. Mint a fresh one.
Can this verify the signature?
Yes for HS256: paste the shared secret and the HMAC is recomputed locally and compared. Asymmetric algorithms like RS256 need the public key and are not verified here.