Decode a JSON Web Token's header and payload, read every claim with expiry and issued-at as real dates, and verify HS256, HS384, or HS512 signatures with your secret.
RS256, PS256, ES256, and EdDSA tokens are decoded but cannot be verified with a shared secret; they need the issuer's public key.
| Claim | Value | Meaning |
|---|
This JWT decoder splits a JSON Web Token into its three parts and shows the header and payload as formatted JSON, so you can see the signing algorithm, token type, issuer, subject, audience, and any custom claims at a glance. Registered claims from RFC 7519 are explained in a table: the exp, nbf, and iat timestamps are converted to your local date and time with a live countdown to expiry, and the token is flagged as valid, expired, or not yet active. If the token uses HMAC (HS256, HS384, or HS512), paste the shared secret to verify the signature with the browser's WebCrypto; nothing is uploaded, which makes it safe for real tokens from your own systems. It is for developers debugging login flows, API authentication, and OAuth or OpenID Connect integrations, support engineers reading tokens out of logs, and anyone who wants to know what an app stored inside their session token.
A JWT (RFC 7519) is three Base64url strings joined by dots: header.payload.signature. The decoder splits on the dots, converts each of the first two parts from the URL-safe Base64 alphabet (RFC 4648 section 5, with - and _ and no padding) back to UTF-8 bytes, and parses them as JSON; the signature part is kept as raw bytes and shown in hex. Numeric date claims (exp, nbf, iat) are seconds since the Unix epoch, so they are multiplied by 1,000 and displayed with the browser's time zone. Validity is exp greater than now and nbf not after now, with no leeway. For HMAC algorithms the signature is HMAC-SHA-256/384/512 over the ASCII bytes of header.payload using the secret; the page imports the secret into WebCrypto, signs the same input, and compares the result byte for byte to the token's signature. RS256 and ES256 tokens are decoded but not verified, since that requires the issuer's public key. Decoding never checks the signature, which is why you must never trust claims from an unverified token.
The page runs entirely in your browser: the token is decoded by JavaScript on your machine and no network request is made. That said, a valid access or session token is a credential, and anyone who copies it can act as you until it expires, so avoid pasting production tokens into any website you do not control, clear your clipboard afterward, and prefer tokens from a development environment when you can.
A standard signed JWT (a JWS) is only Base64url-encoded, not encrypted, so the header and payload are readable by anyone who has the token; the signature merely proves they were issued by someone holding the key and have not been altered. Never put passwords, personal data, or secrets in a JWT payload. If confidentiality is required the token must be encrypted as a JWE (RFC 7516), which has five parts instead of three and cannot be decoded here.
They are the registered time claims from RFC 7519: exp is the expiration time after which the token must be rejected, nbf (not before) is the time before which it must not be accepted, and iat is when it was issued. All three are NumericDate values, seconds since 1970-01-01T00:00:00Z, so 1516239022 is 18 January 2018 01:30:22 UTC. This page converts them to your local time and shows how long until expiry; servers usually allow a small clock-skew leeway of a minute or so.
Common causes are pasting the secret with a trailing space or newline, a secret that the server stores Base64-encoded (tick the option to decode it first), an algorithm mismatch such as HS512 versus HS256, or a token that was actually signed with an RSA or ECDSA key (RS256, ES256) which cannot be verified with a shared secret. If the header says alg none the token has no signature at all and should be rejected by any server; accepting alg none was the source of several real-world vulnerabilities.
JSON Formatter · Base64 Encode / Decode · URL Encode / Decode · Regex Tester · Hash Generator · UUID Generator · HTML Entity Encoder · Color Converter · Password Generator · Number Base Converter · QR Code Generator · Chmod Calculator
Browse all Developer Tools, or go back to every free tool on HeroYears.