JWT Decoder

A JSON Web Token (JWT) packs a header, a payload of claims, and a signature into a compact, URL-safe string used for authentication and authorization. This decoder splits a token into its three parts and shows the decoded header and payload as readable JSON, so you can inspect claims like iss, sub, aud, iat, and exp at a glance. It flags the standard timestamp claims and tells you whether the token is expired or not yet valid.

You can also verify an HMAC (HS256/384/512) signature by pasting the shared secret — the check runs locally with the Web Crypto API. Because a JWT often carries session or identity data, nothing you paste is transmitted: decoding and verification happen entirely in your browser. Use it to debug auth flows, confirm what an API is issuing, or work out why a token is being rejected — without exposing sensitive tokens to a third-party site.

Paste a JSON Web Token to inspect its header and payload. Decoding and signature verification happen entirely in your browser — your token and secret are never sent anywhere.

Frequently asked questions

Is it safe to paste a real token here?
Yes. Decoding and signature verification run entirely in your browser; the token and any secret you enter are never uploaded or logged.
Does decoding a JWT verify it is authentic?
No. Decoding only reveals the contents. Authenticity requires verifying the signature with the correct key — this tool verifies HMAC (HS*) signatures locally when you supply the shared secret.
Can it tell me whether a token is expired?
Yes. It reads the exp and nbf claims and tells you if the token is expired or not yet valid, based on your device clock.
Which signature algorithms can it verify?
HMAC-based algorithms HS256, HS384, and HS512 using a shared secret. Asymmetric (RS/ES) verification needs the public key and is not performed here.
Why does my payload look garbled?
The middle segment is Base64URL-encoded JSON. If it will not decode, the token may be malformed or truncated — check that all three dot-separated parts are present.