Decoder

JWT decoder

Paste a token to read its header and claims, with expiry and validity windows worked out for you. Your token never leaves this page — which matters more here than anywhere else on this site, because a JWT is a live credential.

Encoded token
Waiting for input.
Header
Payload / claims

Decoding is not verification. Without a secret this only reads the token; with one, HS256/384/512 signatures are checked via WebCrypto in the browser. RS/ES tokens need a public key and are not verified here. ⌘/Ctrl + Enter runs it again. Everything happens in this browser — nothing is uploaded.

About the JWT decoder

A JWT is a credential. Pasting one into a website that decodes it server-side hands someone a session, which is why this decoder runs entirely in the page: the token is split and base64url-decoded locally, and if you supply the signing secret, the HMAC signature is verified with the browser's own WebCrypto. Expiry and not-before claims are worked out for you in plain language.

How to use it

  1. Paste the token (a "Bearer " prefix is fine — it gets stripped).
  2. Read the header and claims; timestamps are annotated with how long ago or how far ahead they are.
  3. Optionally paste the signing secret to verify an HS256, HS384 or HS512 signature.

Questions

Is my token sent anywhere?

No, and this is the one page where that matters most. Decoding and verification both happen in your browser. There is no backend to receive it.

Can it verify RS256 or ES256 tokens?

No. Those are signed with a private key and verified with the matching public key, which this tool does not ask for. RS/ES tokens are decoded and clearly reported as unverified.

Does decoding mean the token is valid?

No. Anyone can read a JWT — the payload is only base64-encoded, not encrypted. Only a signature check with the right key proves it is genuine, which is what the secret field is for.