JWT decoder

How to use this tool

1. Paste the token into the box. A leading "Bearer " is removed for you.
2. Read the header, payload and the claims table with readable dates.
3. Check the expiry warning to see whether the token is still valid.
4. To check the signature, enter a test secret or a PEM public key.

How it works

A JWT has three parts separated by dots: a header that names the signing algorithm, a payload of claims such as the subject, issuer and expiry, and a signature. The first two parts are only Base64URL-encoded JSON, so anyone holding a token can read them. The decoder shows both, turns time claims such as exp, iat and nbf into readable dates and tells you whether the token has expired.

To check a signature, enter the shared secret for HS256, HS384 or HS512, or a PEM public key for RS, PS and ES algorithms. The check uses your browser's Web Crypto API. Encrypted tokens (JWE, five parts) cannot be read without the private key and are not decoded.

Good to know

Decoding is not verifying. A server must check the signature, the algorithm it expects, the issuer, the audience and the expiry before trusting any claim. Watch out for tokens with alg set to none: they are unsigned and must be rejected. Because the payload is readable by anyone, never put passwords or other secrets inside a JWT.

This page runs entirely in your browser and makes no network requests with your token. Even so, treat a production token like a password: it can sign someone in until it expires. Use tokens from a test environment, or ones that have already expired, when you debug.