JWT Decoder
Paste a JWT to see its header and payload decoded, the standard claims with human-readable dates and the expiry status; optionally verify an HMAC signature with the shared secret.
- Runs in your browser
- Free to use
About this tool
JSON Web Tokens carry claims in base64url-encoded JSON that is signed, not encrypted, so anyone holding a token can read it. The JWT Decoder splits the token into header, payload and signature, decodes the two JSON parts, lists the standard claims with readable dates and the current status (expired, not yet valid, no expiry), flags unsigned tokens, and can recompute an HMAC signature with your secret using the browser's Web Crypto API. Nothing is sent to our servers, so it is safe to inspect real session tokens.
Related: Base64 Encode/Decode and Epoch Converter.
How to use it — quick steps
- 01
Enter the json web token
Type or paste the json web token in the field above. Nothing is uploaded. Use Ctrl + V to paste.
- 02
Press "Decode JWT"
Press "Decode JWT" or Ctrl + Enter. The result appears instantly below the form. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form instantly. Every block has [copy] and other actions.
Key features of this tool
Nothing leaves your browser
The processing is plain JavaScript that runs on your device: the text you paste is never uploaded to our servers or to anyone else.
Instant results
Results appear the moment you press the button, even for long inputs, and every block has copy and download actions.
Works everywhere
No installation, no account and no limits: the tool works on desktop and mobile, in any modern browser, as often as you like.
Frequently asked questions
Is the token verified?
Decoding never requires the key, so by default the signature is only displayed. Enter the shared secret to verify HS256/HS384/HS512 tokens; RSA and ECDSA tokens (RS*, ES*, PS*) need the issuer's public key and are not verified here.
What do iat, exp and nbf mean?
Issued at, expires at and not before, as Unix timestamps. The decoder converts them to UTC dates and tells you whether the token is expired or not yet valid.
Why does the tool say the token is unsigned?
The third part is missing or the alg is "none": such tokens carry no proof of origin and must never be accepted by a server.
Are my files or data uploaded?
No. The tool is plain JavaScript that runs in your browser; the files or data you provide here are never uploaded to our servers.