JWT Decoder
Read the header and payload of a JSON Web Token, see when it was issued and when it expires, and optionally verify an HS256/384/512 signature.
Result
Paste a JWT to decode its header and payload.
How to use this tool
- Paste a token (with or without the “Bearer ” prefix).
- The payload is shown as formatted JSON, with time claims such as exp and iat converted to dates.
- To check an HMAC signature, enter the shared secret. RSA and ECDSA signatures (RS256, ES256…) are decoded but not verified.
How it works
A JWT has three Base64URL-encoded parts separated by dots: header, payload and signature. The header and payload are decoded as JSON. For HS256/384/512 tokens, the signature is recomputed as HMAC-SHA(header.payload, secret) with the Web Crypto API and compared with the token’s signature.
Example
The standard example token
The well-known example token decodes to {"sub":"1234567890","name":"John Doe","iat":1516239022} with header {"alg":"HS256","typ":"JWT"}. With the secret “your-256-bit-secret”, the signature verifies.
Privacy and limitations
- Tokens and secrets are processed only in your browser and never sent anywhere.
- Even so, avoid pasting live production tokens or secrets into any website you don’t control.
- Decoding is not validation: always verify signatures, issuer and audience on your server.
Frequently asked questions
Is the payload of a JWT encrypted?
No. Standard signed JWTs are only encoded — anyone holding the token can read the payload. Never put secrets in it.
What does exp mean?
exp is the expiry time in seconds since 1 January 1970 UTC. After it, the token should be rejected.