Developer tool

JWT Decoder Online

Read a JSON Web Token's header and payload, inspect expiry claims, and verify HS256, HS384 or HS512 signatures with your own key.

Samples:
Encoded Token
Invalid JWT format
Signature Verifier HS256
ℹ️ Enter key to verify signature
Token Status -
Expires (exp) -
Status -
Issued At (iat) -
Header
Algorithm 
{}
Payload Claims
Data 
{}

How to use this tool

  1. Paste a test JWT into the token field without the Bearer prefix.
  2. Inspect the decoded header and payload, including exp, iat and nbf where present.
  3. For signature verification, select the supported algorithm and supply the appropriate key. Review the verification result separately from the decoded claims.

Example and use case

A JWT payload might contain {"sub":"demo-user","iat":1704067200,"exp":1704070800}. These claims use Unix time in seconds.

Limitations to check

Decoding is not authentication. Verification here supports HS256, HS384 and HS512 HMAC signatures; RSA, EC and PSS tokens can be inspected but their signatures are not verified by this implementation. A readable token can be forged or expired. A signature check does not enforce issuer, audience or authorization rules. Use synthetic tokens when possible.

Processing and privacy

The tool's browser code handles entered text or selected files locally. Optional URL imports and external resources can make network requests. This website also uses third-party scripts, including analytics and advertising. Read the privacy policy and use sample data when testing sensitive workflows.

Found a problem? Report a tool issue with the browser version and steps to reproduce it. Avoid sending private document content or credentials.

Frequently asked questions

Does decoding prove that a JWT is valid?

No. Decoding only exposes encoded data. Authentication also requires signature verification and checks such as expiry, issuer and audience.

Is a JWT encrypted?

An ordinary signed JWT uses Base64url encoding for its header and payload, which anyone holding the token can read. Encrypted JWTs use a different structure.

Why does my token show an expiration date?

The exp claim is a NumericDate expressed in seconds since the Unix epoch. Its presence does not by itself prove that the token is trustworthy.

Related tools

Practical guides

Essential storage

Remembers your theme and cookie choices, and supports features you use.

Always on

We remember your choices for 180 days. Cookie policy