JWT Decoder

Paste a JWT below to decode and inspect its header, payload and signature. Note: this tool does not verify signatures. All processing happens locally in your browser.

Copied!
Token Info
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts separated by dots (.):
  1. Header - algorithm and token type (e.g. HS256, RS256)
  2. Payload - claims/data (e.g. sub, iat, exp)
  3. Signature - verifies the token hasn't been tampered with
Decoding a token proves nothing about it, because the header and the payload are only base64url and anyone can rewrite them. The signature is the part that matters, so paste the shared secret and the page checks it here, in your browser, for HS256, HS384 and HS512. The other algorithms sign with a private key and verify with a public one, which is not something a page like this should ask you to paste. Times are shown against your own clock, with the gap spelled out, because an expiry is usually the thing you are actually looking for.
Note: This tool only decodes the token. It does not verify the signature.
Related tools
Base64 Decode 
Hash Generator 
Timestamp Converter 
How are you actually storing that?
Hashes, tokens and passwords are only as strong as the code around them: a cost factor left at the default, a token nobody checks the expiry on, a secret committed to the repository. We review and harden applications, and we tell you what an attacker reaches first.
Book a security review 
Frequently Asked Questions
Does decoding a token mean it is valid?

No, and this is the mistake worth avoiding. The header and payload are only base64url, so anyone can rewrite them and produce something that decodes perfectly. Only the signature says the token came from who it claims to. Paste the secret and this page checks it.
Which algorithms can you verify here?

HS256, HS384 and HS512, which sign with a shared secret. RS, ES and PS tokens sign with a private key and verify with a public one, and pasting either into a web page is a habit worth not forming. For those, verify in your own code with the published key set.
What does a token with alg set to none mean?

That it carries no usable signature at all, so the payload can say anything. It exists in the specification for tokens that are protected some other way, and it is a well known attack when a library accepts it by default. If you see it on a real token, treat the token as untrusted input.
Is it safe to paste a real token here?

The page never uploads anything, so nothing leaves your browser. Even so, a live token is a credential, and the secret field is deliberately excluded from the saved settings and from the query string so it cannot be stored or shared by accident. Revoke anything you paste in a place you do not control.
Why does the expiry show a time difference?

Because that is usually the question. A token that expired four minutes ago and one that expires in four hours look almost identical as numbers, so the page renders both against your own clock and spells out the gap. Times can be shown in UTC if you are comparing against a server log.