JWT Decoder
Paste a JSON Web Token to see its header and payload as formatted JSON, with expiry and issue times as readable dates. Add the secret or public key to check the signature.
- Runs on your device
- No sign-up
- Free, no watermark
How to use the JWT Decoder
- 01Paste a JWT into the Encoded token box, or press Sample to try one.
- 02Read the decoded header and payload. Times show as dates, with how long ago or how long is left.
- 03To check the signature, enter the secret (HS algorithms) or paste the public key (RS, PS, ES, EdDSA).
- 04The result shows Signature valid or Signature invalid. Copy any part with its copy button.
Good to know
The token stays here
Decoding and verification run in your browser. The token, secret and key are never sent anywhere or saved.
Readable times
exp, iat and nbf are shown in your time zone and in UTC, with how long ago or how long is left.
Signature check
Verify HS256/384/512 with a secret, or RS, PS, ES and EdDSA tokens with a PEM or JWK public key.
Clear errors
A wrong number of parts, bad base64url or a part that isn't JSON is named in plain words.
Frequently asked questions
Is my token sent to a server?
No. The token is decoded by JavaScript in this page and the signature is checked with your browser's Web Crypto. Nothing you paste is uploaded, logged or stored.
Does decoding a JWT prove it's genuine?
No. Anyone can read a JWT's header and payload, because they're only base64url-encoded. Only a valid signature shows that the token came from someone with the key and hasn't been changed.
Which algorithms can it verify?
HS256, HS384 and HS512 with a shared secret; RS256, RS384, RS512, PS256, PS384 and PS512 with an RSA public key; ES256, ES384 and ES512 with an EC public key; and EdDSA with an Ed25519 key in browsers that support it.
What key format does it need?
A PEM public key that starts with -----BEGIN PUBLIC KEY-----, a JWK, or a JWK set (the key whose kid matches the token is used). Certificates and BEGIN RSA PUBLIC KEY files need converting first, and the tool shows the command.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. Each is a count of seconds since 1 January 1970 UTC.
Can it read encrypted tokens?
No. An encrypted token (JWE) has five parts and can't be read without the decryption key. The tool tells you when it sees one.