Decode JSON Web Tokens
A JSON Web Token (JWT) carries claims about a user or session in three parts: a header, a payload and a signature, each Base64URL-encoded and separated by dots. Paste a token to see its header and payload as formatted JSON, and when it was issued and when it expires, shown in your local time.
For tokens signed with a shared secret (HS256, HS384, HS512) you can enter the secret to check that the signature is valid. Decoding happens entirely in your browser, so tokens — which often grant access to accounts — are never sent anywhere.
Why Use This JWT Decoder?
- Header and payload as formatted JSON
- Expiry, issue and not-before times in your local time
- HS256, HS384 and HS512 signature verification
- Private: the token never leaves your browser
How to Decode a JWT
- Paste the token into the field — a leading "Bearer " is removed automatically
- Read the header, payload and expiry
- Optionally enter the secret to verify an HMAC signature
Frequently Asked Questions
Is this JWT decoder free?
Yes, it is completely free and has no limits.
Is the payload of a JWT encrypted?
No. A normal (signed) JWT is only encoded: anyone who has the token can read its payload. The signature only proves that the token hasn't been changed — so never put secrets into a JWT payload.
Which signatures can be verified?
HMAC signatures (HS256, HS384, HS512), using the secret key. Tokens signed with RS256, ES256 and other public-key algorithms are decoded, but their signature isn't checked here.
Is it safe to paste a real token here?
The token and the secret are processed only in your browser and are never sent to our server. Still, treat production tokens like passwords and paste them only on devices you trust.