JWT Decoder & Verifier
Paste a JSON Web Token to see its header, claims and expiry. Add the secret to verify HMAC signatures.
Encoded token
Header
Payload
Time claims
No time claims (exp, iat, nbf) in this token.
Verify signature
RS*/ES* tokens use public-key signatures, which this tool doesn't verify yet. Decoding still works.
What is a JWT?
A JSON Web Token is three Base64URL strings joined by dots: header.payload.signature. The header names the signing algorithm. The payload carries claims such as the user ID (sub), expiry (exp) and issued-at time (iat). The signature proves that whoever holds the key created the token and that nobody changed it since.
Decoding is not verifying
Anyone can decode a JWT. The payload is only encoded, not encrypted, so never put secrets in it. Your server must always verify the signature before trusting the claims.
Is it safe to paste my token here?
Decoding and verification run entirely in your browser using the Web Crypto API. Still, treat production tokens like passwords and avoid pasting them into any website you don't control.