JWT decoder
Paste a JSON Web Token to read its contents, check whether it has expired and verify its signature.
Sealed on this device
Runs in your browser. Nothing is uploaded.
Sealed
Decoding and verification happen on this device. The token is never sent anywhere.
Decoded
The header, payload and dates of your token will appear here.
Header
Payload
Registered claims
Verify the signature (optional)
Decode a token first. Its algorithm tells which key is needed.
PEM (-----BEGIN PUBLIC KEY-----) or JWK in JSON. Never paste a private key into a website you don’t trust.
How it works
-
Paste the token
Paste a JWT from an Authorization header, a cookie or your logs. A leading “Bearer” is ignored.
-
Read the contents
The header and payload are shown as formatted JSON, with exp, iat and nbf turned into dates in your time zone.
-
Verify if needed
Enter the shared secret or paste the public key to confirm the signature, all without the token leaving your device.
Frequently asked questions
Is it safe to paste a real token here?
The token is decoded and verified in your browser and never sent to any server. Still, a token is like a temporary password: avoid sharing it, and revoke it if it was exposed somewhere else.
Can anyone read the contents of a JWT?
Yes. A standard signed JWT is only Base64url-encoded, not encrypted, so anyone holding it can read the payload. The signature only proves that nobody changed it. Never put secrets in a JWT payload.
Why does it say my token has expired?
The exp claim holds the expiry time, in seconds since 1 January 1970 (UTC). If that moment has passed according to your device’s clock, the token has expired and servers should reject it.
Which signatures can be verified?
HMAC (HS256, HS384, HS512) with a shared secret, and RSA (RS256–512, PS256–512) and elliptic curve (ES256, ES384, ES512) with a public key in PEM or JWK format. Verification uses your browser’s built-in Web Crypto.
What do iss, sub and aud mean?
They are standard claims: iss is who issued the token, sub is who it’s about (often a user ID), and aud is who it’s meant for. Other fields in the payload are specific to the application that created the token.