JWT decoder
Paste a JSON Web Token to read its header and payload, see when it expires, and verify its signature with a secret or a public key. Your token never leaves your browser.
Loading…
How it works
- 1
Paste the token
The whole eyJ… string, with or without "Bearer ". Header and payload are decoded as you paste, each claim labelled.
- 2
Check the dates
Issued at, not before and expiry are shown as dates, with whether the token is valid right now.
- 3
Verify the signature
Enter the secret for HS256/384/512, or a PEM or JWK public key for RS, PS, ES and EdDSA. Verification uses your browser’s built-in crypto.
Questions
- Is it safe to paste a real token?
- Here, yes: decoding and verification run entirely in this tab, and the page is blocked from making network requests. Still, treat live tokens like passwords and prefer expired or test ones when you can.
- Does decoding prove a token is genuine?
- No. Anyone can decode a JWT; the payload is only Base64url, not encrypted. Only verifying the signature with the right key shows it hasn’t been tampered with.
- Which algorithms can it verify?
- HS256, HS384 and HS512 with a shared secret; RS256/384/512, PS256/384/512 and ES256/384/512 with a public key in PEM or JWK form; and EdDSA (Ed25519) in browsers that support it.
- Can it decode encrypted tokens (JWE)?
- No. Encrypted tokens have five parts and need the private key to read; this tool decodes signed tokens (JWS), the common kind.