How to use the JWT Decoder tool
- Paste your tokenPaste a JWT into the box. A “Bearer ” prefix and line breaks are removed automatically.
- Read the contentsThe header and payload are decoded and color-coded, with each claim explained in plain English.
- Check the datesExpiry (exp), issued at (iat) and not before (nbf) are converted to dates, with a clear Expired / Not expired badge.
- Verify the signatureFor HS256, HS384 or HS512 tokens, enter the shared secret to confirm the token is genuine.
Features
- Instant decodingResults update as you paste. No buttons, no waiting.
- Human-readable claimsStandard claims such as iss, sub, aud and exp are labelled and explained.
- Expiry statusSee at a glance whether the token has expired or isn’t valid yet.
- Signature checkVerify HMAC-signed tokens using WebCrypto, right in your browser.
- Safe for real tokensTokens are decoded locally and never sent anywhere, so session tokens stay private.
What is a JWT?
A JSON Web Token (JWT, pronounced “jot”) is a compact, URL-safe way to pass claims between two parties. It is widely used for login sessions, API authentication and single sign-on (OAuth 2.0 and OpenID Connect). A JWT has three parts separated by dots:
- Header: the token type and the signing algorithm, such as HS256 or RS256.
- Payload: the claims, for example who the user is and when the token expires.
- Signature: proves the token was created by someone holding the key and hasn’t been changed.
The header and payload are only Base64URL-encoded, not encrypted. Anyone holding the token can read them, which is exactly what this tool does. Never put passwords or other secrets in a JWT payload.
Standard claims
| Claim | Meaning |
|---|---|
iss | Issuer: who created the token |
sub | Subject: usually the user ID |
aud | Audience: which app or API the token is for |
exp | Expiration time, as a Unix timestamp in seconds |
nbf | Not before: the token isn’t valid before this time |
iat | Issued at: when the token was created |
jti | JWT ID: a unique identifier, used to prevent replay |
The dates are Unix timestamps. Convert any other timestamp with our Timestamp Converter.
Decoding is not verifying
Decoding only shows what a token claims. A server must also verify the signature, check exp and nbf, and confirm the issuer and audience before trusting it. Tokens with "alg": "none" have no signature at all and must always be rejected.
- HS256, HS384, HS512 use one shared secret for signing and checking. Enter it above to verify.
- RS256, ES256, PS256 and similar use a private key to sign and a public key to verify, usually published by the issuer in a JWKS endpoint. Verify these in your backend with a trusted library.
Security tips
- Keep access tokens short-lived (minutes, not days) and use refresh tokens for longer sessions.
- Use a long, random secret for HMAC algorithms; a short, guessable secret can be cracked offline. Our Password Generator can create one.
- Only paste production tokens into tools that run locally, like this one.