What is the JWT Decoder?
A JSON Web Token (JWT) is a compact, signed token that APIs use to carry identity and permissions. It has three parts separated by dots: a header (the algorithm), a payload (the claims, such as who the user is and when the token expires) and a signature. The header and payload are only Base64URL-encoded, not encrypted, so anyone can read them.
Paste a token to see both parts as formatted JSON, with every standard claim explained and timestamps such as exp and iat shown as real dates, plus whether the token has expired. To check that a token has not been tampered with, verify its signature with the shared secret (HS256) or the public key (RS256, ES256, PS256, EdDSA). You can also create HS256 test tokens.
Tokens can grant access to real accounts, so this tool works entirely in your browser: nothing you paste is sent to a server.
How to use it
- Paste the token (with or without “Bearer”) into the box, or click Example.
- Read the header and payload, and the claims table with dates and meanings.
- Check the status line: valid, expired or not yet valid.
- To verify, enter the secret or paste the public key (PEM or JWK) under Verify signature.
- To make a test token, open Create a JWT, edit the payload and secret, and copy the result.
Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
iat = 18 January 2018, 01:30:22 UTCFeatures
- Readable claims. Every registered and common claim (iss, sub, aud, exp, scope, email…) explained in plain English.
- Real dates. exp, iat, nbf and auth_time as dates in your time zone and UTC, with “in 2 hours” or “3 days ago”.
- Expiry check. See at a glance whether the token is valid, expired or not yet valid.
- Signature verification. HS256/384/512 with a secret; RS, PS, ES and EdDSA with a PEM public key or a JWK or JWKS.
- Create test tokens. Sign HS256, HS384 or HS512 tokens with your own payload for local testing.
- Private. Decoding and verification happen in your browser with the Web Crypto API; nothing is uploaded.
Frequently asked questions
Is it safe to paste my JWT here?
Everything runs on your device and nothing is sent anywhere. Even so, treat production tokens like passwords: prefer test tokens, and never share a live token in chat or tickets.
Can anyone read a JWT?
Yes. A normal (signed) JWT is only encoded, not encrypted, so its header and payload are readable by anyone who has it. Never put secrets such as passwords in a JWT payload. Encrypted tokens (JWE) have five parts and need the key to read.
What does “invalid signature” mean?
The signature does not match the header and payload with the key you gave. Either the key is wrong (check for the right environment, or Base64 secrets), or the token was changed after it was signed. A server should reject such tokens.
What do exp, iat and nbf mean?
They are times in seconds since 1 January 1970 (Unix time): exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. This tool shows them as normal dates.
Why does my RSA key not work?
Paste the public key in PEM format starting with -----BEGIN PUBLIC KEY-----, or as a JWK. Keys that start with BEGIN RSA PUBLIC KEY (PKCS#1) need converting first, and the token’s alg must match the key type.
Last updated · Free, no sign-up, runs in your browser.