JWT Decoder Verifier
Decode any JSON Web Token, read its claims in plain English, check expiry, and verify HMAC signatures.
In-browser & private
Encoded token
Decoded
Paste a token on the left, or press
Sample to try one.
Algorithm —
Type —
Expiry —
Size 0 B
Ready
About this JWT decoder
A JSON Web Token has three base64url parts separated by dots: header.payload.signature. The first two are only encoded, not encrypted — anyone holding a token can read its contents, so never put secrets in a payload.
- Decoding is offline. Everything happens in your browser, so pasting a production token here does not transmit it anywhere.
- Signature verification covers HS256/HS384/HS512 via the Web Crypto API. RSA and ECDSA tokens (RS*/ES*/PS*) are still decoded and expiry-checked, but verifying them needs the issuer's public key, which this tool does not handle.
- Expiry is judged against your device clock, including the
nbfnot-before claim.
Working with a plain Base64 payload instead of a token? The Base64 encoder and decoder handles either alphabet, files and data URIs.