JWT Decoder
Inspect JSON Web Token contents.
Token
EmptyLn 1, Col 11 lines, 0 characters
Your token is decoded in this browser and never sent to a server.
A JWT decoder that explains, checks and warns
Paste a token and see what is inside, whether it is still valid, whether its signature is genuine and whether anything about it looks unsafe. All of it runs in your browser.
- Decodes as you paste. Paste a token and the header and payload appear at once as formatted JSON. Choose to see Both, only the Payload or only the Header, with 2 or 4 spaces, tabs or compact output.
- Explains every claim. The Claims tab names each standard claim in plain words, such as
issfor issuer andexpfor expiry, turns timestamps into dates with "in 2 hours" or "3 days ago", and lists custom claims separately. - Checks the signature. Open Verify and add the key. It supports HMAC secrets, RSA, RSA-PSS, ECDSA and Ed25519, with a public key as PEM, a certificate or a JWK. Checking happens in your browser, so a secret never leaves your device.
- Knows when a token is expired. A live badge shows whether the token is valid, expired or not valid yet, and it keeps updating while the page is open. Allow a little clock drift in Settings, as servers usually do.
- Flags risky tokens. It warns about tokens with no expiry, an
algofnone, a missing or empty signature, a signature of the wrong length, an expiry before the issue time and a very long lifetime you can set yourself. - Checks issuer and audience. Enter the issuer and audience you expect in Settings. A token from somewhere else is reported as an error, which is exactly what an API should do.
- Cleans up pasted tokens. Paste a whole
Authorization: Bearer ...header, a cookie value, a token wrapped in quotes or one broken over several lines. The extra text is ignored, and Fix input leaves just the token. Undo restores your original. - Understands encrypted tokens. A five-part encrypted token (JWE) is recognised and its header is shown. The payload stays unreadable without the decryption key, and the tool says so rather than showing garbage.
How this JWT tool compares with other online decoders
Most online decoders print the JSON and stop. Here is what you usually get from a basic one and what this tool adds.
| Feature | Typical online tool | This tool |
|---|---|---|
| Your token | Some sites send it to a server to decode. | Decoding and signature checks run in your browser. Nothing you paste is uploaded. |
| Reading claims | Raw JSON with numbers such as 1735689600. | Plain names, real dates in your time zone or UTC, and how long until it expires. |
| Signature | Often HMAC only, or no check at all. | HMAC, RSA, RSA-PSS, ECDSA and Ed25519 with PEM, certificate and JWK keys. |
| Pasted text | Fails if there is a "Bearer" prefix or a line break. | Finds the token inside the text and repairs it in one click. |
| Security checks | Shows the payload and stops. | Flags no expiry, alg none, wrong signature length, bad dates, and a wrong issuer or audience. |
| Expiry | You work out the date by hand. | A live valid, expired or not-valid-yet badge with adjustable clock drift. |
| Errors | "Invalid token". | Says which part is broken, header, payload or signature, and why. |
| Encrypted tokens | Shows nothing or an error. | Recognises JWE, shows its header and explains why the payload is hidden. |
How to decode and verify a JWT
- Paste a token into the box, drop a text file onto it, or press Open file. Try Samples to see a ready-made token.
- Read the header and payload in the Decoded tab and press Copy, or Download to save them as a JSON file.
- Open Claims to see each claim explained, with dates and the time left before the token expires.
- To confirm the token is genuine, open Verify and enter the secret or public key. The result updates as you type.
- Check Issues for anything risky or broken. Press Fix input if the token was pasted with extra text. Add your expected issuer and audience in Settings.
JWT questions
Is my token uploaded anywhere?
No. Decoding and signature checking run in your browser, and nothing is sent to a server. Even so, treat live production tokens with care and prefer test tokens when you can.
What is a JWT?
A JSON Web Token is a compact way to pass claims between two parties. It has three parts separated by dots: a header that names the algorithm, a payload that holds the claims, and a signature. The first two parts are only Base64URL encoded, not encrypted.
Can anyone read what is inside a JWT?
Yes. The header and payload of a normal signed token are readable by anyone who has it, which is why you should never put passwords or other secrets in the payload. The signature only proves the token was not changed.
What does a valid signature mean?
It means the token was created with the matching key and its header and payload have not been altered. It does not mean the token is still allowed. You still need to check the dates, the issuer and the audience, which this tool also reports.
What do exp, nbf and iat mean?
exp is the time the token expires, nbf is the time before which it must not be accepted, and iat is the time it was issued. All three are counted in seconds since 1 January 1970 UTC, and the Claims tab turns them into dates.
Why is "alg: none" dangerous?
It marks a token as unsigned. A server that accepts it lets anyone create a token with any claims. A safe server rejects it, and this tool warns you whenever it sees one.
Which key do I enter for RS256 or ES256?
The public key, never the private key. Paste it as a PEM block, a certificate or a JWK. If you paste a JWKS with several keys, the one that matches the token header kid is used.
What is the difference between HS256 and RS256?
HS256 uses one shared secret to both sign and check, so anyone who can check it can also forge it. RS256 signs with a private key and is checked with a public key, so the people who check it cannot create tokens.
Why does the tool say my token is expired when the server accepts it?
Servers often allow a small clock difference. Set Allow clock drift in Settings to match your server. The expiry check then uses the same tolerance.