JWT Decoder
Decode JSON Web Tokens to read the header, payload and expiry, and verify the signature. Your token never leaves the browser.
Runs in your browser. Nothing you enter is uploaded
About JWT Decoder
Paste a JSON Web Token to see what's inside: the header with the signing algorithm, the payload with its claims, and whether it has expired. Dates such as exp and iat are shown in plain language, like “expires in 2 hours”.
A token is a password while it's valid, so it should never be pasted into a site that sends it to a server. This decoder runs entirely in your browser. To check the signature, add the secret (HS256, HS384, HS512) or the public key (RS, PS, ES and EdDSA algorithms); it's checked on your device too.
How to use JWT Decoder
- 1Paste your token. A “Bearer ” prefix is fine.
- 2Read the header, payload, claims and expiry.
- 3Optionally, add the secret or public key to verify the signature.
Frequently asked questions
Is my token sent anywhere?
No. Decoding and verification happen in your browser with its built-in cryptography, so the token, secret and keys never leave your device.
Does decoding a token mean it's genuine?
No. Anyone can create a token with any payload. Only a valid signature shows it was issued by someone with the secret or private key, so verify it before trusting the contents.
Which algorithms can be verified?
HS256, HS384 and HS512 with a shared secret; RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA with a public key in PEM (BEGIN PUBLIC KEY) or JWK format.
Can it read encrypted tokens?
No. Encrypted tokens (JWE, with five parts instead of three) can only be read with the recipient's private key, which this tool doesn't ask for.