How to use JWT Decoder
- Paste the JWT (a full "Authorization: Bearer …" header works too).
- Read the summary: algorithm, whether the token is expired, when it was issued and when it expires.
- Inspect the header and payload JSON and the claims table with the meaning of every claim.
- Optionally enter the HMAC secret to verify the signature locally.
- Copy or download the decoded JSON.
JWT Decoder features
- Decodes header, payload and signature segment of any JWS token; recognises JWE tokens
- Explains registered (RFC 7519) and common OIDC/OAuth claims in a readable table
- Converts exp, iat and nbf to UTC dates with "expires in 2h" style notes
- Verdict panel with algorithm, expiry status, issue time and lifetime
- Optional HS256/HS384/HS512 signature verification with a shared secret (UTF-8 or Base64)
- Strips "Bearer" prefixes, quotes and whitespace automatically; live decoding as you paste
- Runs entirely in your browser — tokens are never uploaded
JWT Decoder example
Decode an HS256 access token
Input:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzhmM2EyYyIsIm5hbWUiOiJMYXlsYSBIYXNzYW4iLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6NDEwMjQ0NDgwMH0.…Output:
{
"sub": "user_8f3a2c",
"name": "Layla Hassan",
"role": "admin",
"iat": 1700000000,
"exp": 4102444800
}
Algorithm: HS256 · Expired: No (expires in 73y) · Issued: 2023-11-14 22:13:20 UTCFrequently asked questions about JWT Decoder
Is it safe to paste a production token here?
The token is decoded with JavaScript in your browser and is never sent to a server, logged or stored. Still, treat live tokens as secrets: anyone who obtains one can use it until it expires.
Why can I read the payload without the secret?
A JWT is signed, not encrypted. The header and payload are only Base64url-encoded, so anyone can read them. The signature proves the token was not modified — it does not hide its content. Encrypted tokens (JWE) have five segments and cannot be read without the key.
Can the tool verify the signature?
Yes for HMAC tokens (HS256, HS384, HS512): enter the shared secret and the signature is checked locally with WebCrypto. RS/ES/PS tokens need the issuer's public key and are decoded but not verified here.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds. exp is when the token stops being valid, iat is when it was issued and nbf is the earliest time it may be used. The claims table converts each to UTC and shows how long remains.
The token I pasted starts with "Bearer" — is that a problem?
No. "Bearer " and "Authorization:" prefixes, surrounding quotes and whitespace are stripped automatically before decoding.
Technical notes
A JWS compact token is three Base64url segments separated by dots. The decoder converts the URL-safe alphabet back to bytes, repairs missing padding and parses the header and payload as JSON. Tokens with five segments are JWE (encrypted) — the header is shown but the payload cannot be read without the key.
Signature verification computes HMAC-SHA over "header.payload" with WebCrypto and compares it with the signature bytes. Asymmetric algorithms (RS/ES/PS/EdDSA) are decoded but not verified, because that requires the issuer's public key.