JWT Decoder
Paste a JSON Web Token and read what it contains: the header, every claim, and whether it has expired. Timestamps become real dates. The token never leaves this tab, which matters more here than on any other page.
JWT Decoder
Decoding happens in this tab. Nothing is uploaded — which matters, because a JWT from a running system is a live credential.
Algorithm HS256
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Ada Lovelace",
"admin": true,
"iat": 1516239022,
"exp": 1516242622
}Claims
- Subjectsub
- 1234567890
- Namename
- Ada Lovelace
- adminadmin
- true
- Issued atiat
- 2018-01-18T01:30:22.000Z
- Expires atexp
- 2018-01-18T02:30:22.000ZThis token has expired.
Signature
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Shown, not checked. Verifying a signature needs the signing key, so no browser tool can do it and no website should ask you for one.
How to use it
- Paste the token into the box. A leading "Bearer " is stripped for you.
- Read the algorithm and expiry status on the row underneath.
- Check the claims table — registered claims are labelled and exp, nbf and iat are shown as dates.
- Treat the signature as informational. Verifying it needs the signing key, so no browser tool can do it.
- Rotate any production token you paste into any website, including this one — a JWT is a live credential.
Frequently asked questions
- Is it safe to paste a real JWT here?
- Decoding runs entirely in your browser and the token is never sent anywhere, which you can verify with devtools open. Even so, a token from a live system is a working credential, so rotating it afterwards is the safer habit.
- Why can't this verify the signature?
- Verifying requires the signing key, which only the issuing server has. A page claiming to verify is either asking you to hand over a production secret or is not really checking anything.
- Is the payload encrypted?
- No. It is base64url-encoded, which is an encoding rather than encryption and is trivially reversible. Never put anything confidential in a JWT payload.
Related tools
- Base64 Encoder and DecoderEncode and decode Base64 in your browser, including URL-safe Base64. Handles emoji, Sinhala and Chinese, which btoa-based tools cannot.
- SHA Hash GeneratorGenerate SHA-256, SHA-384, SHA-512 or SHA-1 hashes of any text in your browser, using the Web Crypto API. Nothing is uploaded.
- Unix Timestamp ConverterConvert a Unix timestamp to a readable date and back, in seconds or milliseconds, with UTC and local time shown side by side.
Built and maintained by Kavitha Kanchana
Software engineer at Cortana AI and co-founder of Ryzera Technologies, based in Sri Lanka. Found a bug or a wrong number? Email me.