Decode JWT tokens instantly: inspect the header, payload claims, and expiry, verify HMAC signatures, or generate signed test tokens. All processing runs in your browser.
A JWT (JSON Web Token) is a compact, URL-safe token format used to transmit claims between parties, most commonly for authentication and API authorization. A JWT is not encrypted: its header and payload are just Base64Url-encoded JSON that anyone can decode and inspect. This JWT decoder splits a token into its three parts, decodes the header and payload, and shows the registered claims, including expiry, in human-readable form.
Paste your token into the input above; decoding happens instantly as you type. The tool works as a JWT debugger and viewer: the decoded header shows the signing algorithm (alg) and token type, the payload shows all claims, and timestamps like exp, iat, and nbf are converted from Unix time to readable dates with a live expiry status. To verify an HMAC signature, enter the shared secret and the decoder recomputes the signature locally and tells you whether it matches.
Switch to the Generate JWT tab to use this tool as a jwt generator: edit the payload JSON, pick an algorithm (HS256, HS384, or HS512), and enter a secret, and a signed token appears instantly. You can also hit Edit & re-sign on any decoded payload to tweak a real token and sign it with your own secret. It's ideal for creating test tokens during API development, seeding integration tests, or learning how a jwt encoder builds the three sections of a token. Tokens are signed locally with the Web Crypto API; the secret never leaves your browser.
Every JWT has three Base64Url-encoded sections separated by dots: header.payload.signature. The header identifies the signing algorithm (like HS256 or RS256) and token type. The payload carries the claims: registered claims like iss (issuer), sub (subject), and exp (expiration), plus any custom data. The signature is computed over the first two sections with a secret or private key, letting the receiving server detect tampering. Because only the signature is protected, never store secrets in the payload.
Developers use a JWT decoder to debug authentication issues, check token expiry during API development, inspect claims returned by identity providers like Auth0, Firebase, Keycloak, or Cognito, validate that a backend issues correctly formed tokens, and learn how JSON Web Tokens work. Because this jwt decode tool runs fully in your browser, it's safe to paste real production tokens; nothing is uploaded or logged.
It depends on the tool. Many online decoders send your token to a server, where it could be logged. This decoder runs entirely in your browser; the token never leaves your device, so it's safe even for production tokens. Still, treat any token that may have leaked as compromised and rotate it.
The header and payload of a JWT are only Base64Url-encoded, not encrypted, so anyone can decode and read them. The secret key is used to create the signature, which proves the token wasn't tampered with. Never put passwords or other sensitive data in a JWT payload.
Paste your token and the decoder reads the exp (expiration) claim, converts it from a Unix timestamp to a human-readable date, and tells you whether the token is still valid or how long ago it expired. The iat (issued at) and nbf (not before) claims are shown the same way.
Yes, for HMAC-signed tokens (HS256, HS384, HS512). Enter the secret and the decoder recomputes the signature with the Web Crypto API and compares it to the one in your token. Verification also happens locally; the secret is never transmitted. RSA and ECDSA tokens (RS256, ES256, etc.) can be decoded but not verified, since that requires the public key infrastructure of the issuer.
The modern code editor for the web, built for developers who value speed and simplicity.
Download Now