🔐 JWT Decoder
Inspect a JSON Web Token without sending it to a third-party site – claims, expiry and algorithm at a glance.
⚠ Decoding is not verification: anyone can create a token with any payload. The signature is not verified unless you check it with the secret below.
Header
Payload
Registered time claims
Verify HS256 signature (optional)
How to use the JWT Decoder tool
- Paste the token (a leading "Bearer " is removed automatically).
- Read the pretty-printed header and payload and the expiry badge.
- Optionally enter the HS256 secret to verify the signature.
Frequently asked questions
Is it safe to paste a production token here?
Decoding happens entirely in your browser – nothing is sent or logged. Still, treat live tokens like passwords: prefer expired or test tokens when sharing your screen.
Does decoding mean the token is valid?
No. The header and payload are just Base64URL-encoded JSON that anyone can create or edit. Only signature verification with the right key proves the token was issued by your server and not altered.
Why can't I verify RS256 or ES256 tokens?
Those need the issuer's public key (often from a JWKS URL). This tool verifies HS256 shared-secret tokens only; check asymmetric tokens in your backend library.
What do exp, iat and nbf mean?
They are Unix timestamps in seconds: exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted.