JWT Decoder – Decode and Verify JSON Web Tokens Online
Paste a JSON Web Token to see its header and payload as formatted JSON, check its issue and expiry times, and optionally verify an HMAC signature with your secret.
A JWT has three Base64URL parts separated by dots: header.payload.signature. Paste it to see the decoded header (algorithm) and payload (claims such as sub, iat and exp). The tool shows whether the token has expired. Decoding does not prove it is genuine — enter the secret to verify HS256, HS384 or HS512.
How to use JWT Decoder
- Paste the token (with or without “Bearer ”).
- Read the status: expired or not.
- Check the header and payload JSON.
- Optionally enter the secret to verify an HMAC signature.
- Copy the header or payload if you need it.
How a JWT is built
A JSON Web Token is three pieces of Base64URL-encoded text joined by dots:
header.payload.signature
- The header says which algorithm signed the token, for example HS256 or RS256.
- The payload contains the claims: who the token is about, when it was issued and when it expires.
- The signature proves the header and payload were created by someone with the key and not changed since.
Base64URL is an encoding, not encryption. Anyone who has the token can read the payload, so never put passwords or secrets inside a JWT.
Standard claims
| Claim | Meaning |
|---|---|
| iss | Issuer — who created the token |
| sub | Subject — usually the user ID |
| aud | Audience — who the token is for |
| exp | Expiry time (Unix timestamp) |
| nbf | Not valid before this time |
| iat | Issued at |
| jti | Unique token ID |
Times are Unix timestamps in seconds. The decoder converts them to your local date and time; for other timestamps use the Unix Timestamp Converter converter.
Decoding is not verifying
Reading a token tells you what it claims, not whether it is real. A server must always verify the signature before trusting a token. For HMAC algorithms (HS256, HS384, HS512) you can paste the shared secret here to check it. RS256 and ES256 tokens use public-key signatures and need the issuer’s public key, which this tool does not check.
Common problems
- “Expired”: the exp claim is in the past; request a new token or check your server clock.
- Invalid format: the token was cut off when copying, or includes quotes.
- Signature mismatch: wrong secret, a different environment (test vs live) or a modified token.
Privacy
Tokens often grant access to accounts. This decoder runs entirely in your browser, so the token is never sent anywhere. Still, treat real production tokens like passwords and avoid pasting them into tools you do not trust. Related: Base64 Encode / Decode and JSON Formatter.
You may also find these free tools useful: JSON Formatter, Password Generator and Regex Tester.
Frequently asked questions
How do I decode a JWT?
Paste it into the decoder. The header and payload are Base64URL-decoded and shown as formatted JSON.
Is it safe to decode a JWT online?
This tool runs locally in your browser and sends nothing. The payload is not secret anyway, but the token itself can grant access, so handle it carefully.
How do I know if a JWT has expired?
Look at the exp claim. The decoder converts it to a date and shows whether it is in the past.
Can I verify the signature?
Yes for HS256, HS384 and HS512: enter the secret. RS and ES tokens need the public key and are not verified here.
Is a JWT encrypted?
Normally not. Standard JWTs (JWS) are only signed; anyone can read the payload.
Last updated: