JWT Decoder

Decode & verify a JSON Web Token instantly.

Paste a JSON Web Token to decode its header and payload, see every claim explained with human-readable dates for exp, iat and nbf, and optionally verify the HMAC (HS256/384/512) signature against your secret. Decoding needs no key and runs fully in your browser — nothing is uploaded.

How to use JWT Decoder

  1. Paste your token

    Drop any JSON Web Token into the box, or click Example to load a sample, and this free online JWT decoder splits it on the dots right in your browser.

  2. Read the header

    The colour-coded header panel shows the decoded JSON, revealing the signing algorithm and token type so you can see how the JWT was created.

  3. Inspect the payload

    View the decoded payload claims instantly, with a badge that tells you at a glance whether the token is active, expired or not yet valid.

  4. Review the claims

    Every reserved claim is explained in plain English, and exp, iat and nbf timestamps are converted to readable local dates with relative time.

  5. Verify the signature

    For HS256, HS384 or HS512 tokens, enter the shared HMAC secret to confirm the JWT signature is valid and the token has not been tampered with.

  6. Copy decoded JSON

    Use the copy buttons to grab the decoded header or payload JSON, ready to debug an API, inspect auth tokens or learn how JWTs really work.

Frequently asked questions

How do I decode a JWT?

Just paste the token into the box above. The decoder splits it on the two dots, Base64URL-decodes the header and payload, and shows you the JSON for each part plus a claim-by-claim explanation. No secret, key or login is needed to decode — only to verify the signature.

Is it safe to paste my token here?

Yes — decoding and verification happen entirely in your browser with JavaScript and the Web Crypto API. Your token and secret are never sent to a server, logged or stored. That said, treat real production tokens carefully and avoid pasting them into any online tool you don't control.

Do I need the secret to decode a token?

No. The header and payload are just Base64URL-encoded JSON, so they decode without any key. The secret is only needed to verify the signature — i.e. to prove the token was issued by someone who holds that secret and hasn't been modified.

What are the three parts of a JWT?

A JWT has the form header.payload.signature. The header is JSON describing the signing algorithm (alg) and type (typ). The payload is JSON holding the claims. The signature is a keyed hash of the first two parts that proves the token is authentic. Each part is Base64URL-encoded and separated by a dot.

How do I verify a JWT signature?

Paste the token, switch on verification and enter the shared secret used to sign it. The tool recomputes the HMAC over the header and payload and compares it to the signature. A green badge means the signature is valid and the token is untampered; a red badge means the secret is wrong or the token was modified.

Why does verification say “not supported”?

This tool verifies HMAC algorithms (HS256/384/512), which use a single shared secret. RS256, ES256 and PS256 are asymmetric — they're verified with a public key, not a secret — so they're decoded here but not signature-checked.

What do exp, iat and nbf mean?

They're timestamps in seconds since 1 January 1970 UTC (NumericDate). exp is when the token expires, iat is when it was issued, and nbf is the earliest time it's valid. The tool converts them to readable local dates and tells you how long ago / until each one is.

Is a JWT encrypted?

No. A standard signed JWT (JWS) is only encoded and signed, not encrypted — anyone can read the payload. Don't put sensitive data in it. If you need the contents hidden, you'd use JWE (encrypted tokens), which is a different format.

Related tools — Developer · JWT tools