JWT Decoder

Decode a JSON Web Token to see its header and payload, check expiry, and verify HS256/384/512 signatures.

Loading…

How to use

  1. Paste the token into the box. A leading "Bearer " is ignored, so you can paste the value of an Authorization header as is.
  2. Read the decoded Header and Payload. The Copy button next to each heading copies it as formatted JSON.
  3. If the payload has an exp claim, the line above shows Expired or Not expired and how long ago or from now, updated every second.
  4. The table lists iat (issued at), nbf (not before) and exp (expires) as dates in your local time zone, each with a relative time.
  5. Under Signature, for an HS256, HS384 or HS512 token, type the secret into the Secret key (HMAC) box to see whether the signature is valid.

Frequently asked questions

If a token decodes, does that mean it is valid?
No. The header and payload are only Base64URL-encoded, so anyone can read them or forge new ones. A token can be trusted only when its signature checks out with the correct key and its alg, exp, nbf, iss and aud are what your application expects; this tool can check the signature for HS256/384/512 when you enter the secret.
Which signature algorithms can be verified?
Only HMAC: HS256, HS384 and HS512. Public-key algorithms such as RS256, ES256 and PS256 need the issuer's public key, which this tool does not take, so for them it only decodes. The secret is used as plain text (UTF-8); a Base64-encoded secret is not decoded first.
How are iat, nbf and exp interpreted?
They are read as seconds since 1970-01-01 UTC and shown in your local time zone; non-numeric values are not shown in the table. The Expired / Not expired status is based on exp only, so check nbf yourself to see whether the token is usable yet.
Why does it say this is not a valid JWT?
The input must have three dot-separated parts, and the first two must be Base64URL-encoded JSON objects. Encrypted tokens (JWE, five parts) and truncated or mis-copied tokens cannot be decoded.
Is my token or secret sent to a server?
No. Decoding and verification happen in your browser; the token and secret are not sent to our server or anywhere else.