About JWT Decoder
Decode a JSON Web Token, inspect its header and claims, check expiry, and verify the signature — all locally, so tokens stay private.
What it does
Paste a token to see its header and payload decoded, with the registered claims interpreted rather than shown as raw numbers: exp, iat and nbf are rendered as readable dates and flagged when the token is expired or not yet valid. Signature verification runs locally with a secret or public key you supply.
Anyone can read a JWT
The header and payload of a standard JWT are Base64url-encoded, not encrypted. Anyone holding the token can read every claim in it — which is why a JWT must never carry a password, a card number, or anything else you would not hand to the bearer. The signature proves the token was not altered; it does not hide anything. That is also why pasting a live token into a random website is a genuine risk, and why verification here never leaves your browser.
Common questions
- Is it safe to paste a real token here?
- Yes. Everything happens in your browser — nothing you enter is uploaded, and the tool keeps working with no network connection. Nothing about the token, or the key you verify it with, is transmitted. Be careful with tools that cannot say the same.
- Is a JWT encrypted?
- Not by default. A standard signed JWT is merely encoded — anyone can read the claims. Only the JWE variant encrypts the payload.
- What does 'invalid signature' mean?
- The token was altered after signing, or you verified with the wrong key or algorithm. Check that the algorithm in the header matches the key type you supplied.
- Which algorithms are supported?
- The common HMAC family (HS256/384/512) with a shared secret, and RSA and ECDSA families with a public key.
- Can I check whether a token is expired?
- Yes — exp, iat and nbf are shown as readable dates, with expired or not-yet-valid tokens flagged.