Tools
EN

JWT Decoder

Paste a JSON Web Token to decode its header and payload instantly. Expiration dates are shown in your local time, and you can verify the signature with your secret or public key.

Private: your data is processed in your browser and never uploaded.

How to decode a JWT

  1. Paste the token (a leading Bearer is removed automatically).
  2. Read the decoded header and payload as formatted JSON and check the claims table for expiry and issue dates.
  3. Optionally open Verify signature and enter the HMAC secret or the public key in PEM format.

How a JWT is built

A JSON Web Token consists of three Base64URL-encoded parts separated by dots: header.payload.signature. The header names the signing algorithm (for example HS256 or RS256), the payload contains the claims, and the signature proves that the first two parts were not changed.

Registered claims

Frequently asked questions

Is it safe to paste my token here?

The token is decoded in your browser and never sent anywhere. Still, treat live tokens like passwords and avoid sharing them.

Can anyone read the payload of a JWT?

Yes. A signed JWT is only Base64URL encoded, not encrypted, so never put secrets in the payload. Only encrypted tokens (JWE) hide their contents.

Why is the signature not checked automatically?

Verification needs the secret or public key of the issuer. Enter it under Verify signature; HS, RS, PS and ES algorithms are supported.

Related tools