JWT Decoder & Verifier

Decode any JSON Web Token, read its claims in plain English, check expiry, and verify HMAC signatures. Your token never leaves this browser.

Advertisement
100% client-side — nothing is sent to a server
Encoded token Ctrl + Enter to decode
Decoded
Paste a token on the left, or press Sample to try one.
Algorithm — Type — Expiry — Size 0 B

About this JWT decoder

A JSON Web Token has three base64url parts separated by dots: header.payload.signature. The first two are only encoded, not encrypted — anyone holding a token can read its contents, so never put secrets in a payload.

  • Decoding is offline. Everything happens in your browser, so pasting a production token here does not transmit it anywhere.
  • Signature verification covers HS256/HS384/HS512 via the Web Crypto API. RSA and ECDSA tokens (RS*/ES*/PS*) are still decoded and expiry-checked, but verifying them needs the issuer's public key, which this tool does not handle.
  • Expiry is judged against your device clock, including the nbf not-before claim.

More free tools