JWT Decoder
Paste a JSON Web Token to read its header, payload and claims in plain language, see whether it has expired, and verify its HMAC signature — all in your browser, with nothing uploaded.
Decoding happens entirely in your browser — nothing is uploaded. Even so, a JWT is a credential: avoid pasting live production tokens into any online tool, including this one.
Encoded token
Decoded
Paste a token to see what is inside it.
How a JWT is put together
A JSON Web Token is three Base64URL-encoded parts joined by dots. The header says which algorithm signed it. The payload carries the claims — who the token is about, who issued it, and when it expires. The signature is what proves the first two parts have not been altered.
Because the first two parts are only encoded, not encrypted, never put anything secret in a payload. Anyone who intercepts the token can read it — including this page.
- Read any token. Header, payload and every claim, decoded instantly as you paste.
- Understand the claims. Registered claims are named and explained, and timestamps become real dates.
- Check the clock. Expired, not-yet-valid and time-remaining are shown at a glance.
- Prove it is genuine. Verify an HMAC signature against your shared secret.
Frequently asked questions
Is my token sent to your server?
No. Decoding and signature verification both run in your browser using the built-in Web Crypto API, so neither the token nor the secret leaves your device. Even so, treat a JWT as a credential and avoid pasting live production tokens into any online tool.
Does decoding a token mean it is valid?
No, and this is the most common misunderstanding about JWTs. The header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them. Only checking the signature against the key tells you the token is genuine and unmodified.
Which algorithms can be verified here?
HS256, HS384 and HS512 — the HMAC family, which uses one shared secret. Asymmetric algorithms such as RS256, ES256 and PS256 are signed with a private key and verified with the issuer’s public key, which this tool does not handle; it tells you when a token uses one instead of guessing.
What do exp, iat and nbf mean?
They are timestamps in seconds since 1 January 1970. exp is when the token stops being accepted, iat is when it was issued, and nbf is the earliest time it may be used. The tool converts all three to readable dates and shows how long is left.
What does “alg: none” mean?
It means the token carries no signature at all. Accepting such a token lets anyone forge any payload, so it should always be rejected. The decoder flags it when it sees one.
Can I decode an encrypted token?
No. A token with five dot-separated parts is a JWE — its contents are encrypted and cannot be read without the decryption key. This tool handles signed tokens (JWS), which have three parts.
Building something that needs secure auth?
AgileTechForge builds web platforms, mobile apps and ERP systems with authentication done properly.
Talk to our team