useforfreeWhat this does
A JSON Web Token (JWT) carries login and permission details between apps. This decoder splits a token into its header, payload and signature, shows them as readable JSON, explains each claim, and turns timestamps like exp and iat into real dates, telling you if the token has expired. You can also verify the signature with the shared secret (HS256, HS384, HS512) or a public key (RS, PS and ES algorithms) to prove the token is genuine. Nothing is uploaded.
How to use it
- Paste a token. It is decoded straight away.
- Check the claims table and the expiry status.
- To check the signature, enter the secret or public key and press Verify signature.
FAQ
Is it safe to paste my token here?
Yes. The token is decoded and verified by your own browser and is never sent anywhere or stored. Still, treat live tokens like passwords and don't share them.
Does decoding a JWT prove it is genuine?
No. Anyone can read a JWT, because the header and payload are only Base64URL-encoded. Only a valid signature, checked with the right secret or public key, proves who issued it and that it wasn't changed.
Which algorithms can be verified?
HS256, HS384 and HS512 with the shared secret, and RS256/384/512, PS256/384/512 and ES256/384/512 with a public key in PEM (BEGIN PUBLIC KEY) or JWK format.