Developer tool
JWT Decoder
Decode a JSON Web Token in your browser: see the header, payload and claims explained, exp and iat as dates, and optionally verify an HMAC signature.
Free, no sign-up. Runs in your browser; nothing is uploaded.
Token
How to use the jwt decoder
See what is inside a JWT
A JSON Web Token is three Base64URL strings separated by dots: a header, a payload and a signature. This tool splits them, decodes the first two and lays the information out so you can see who the token is for, what it allows and when it stops working.
Everything stays in your browser
The token and any key you type are processed by JavaScript in this tab. There is no upload, no analytics on the content and no request that carries it. You can even disconnect from the internet after the page loads and the tool keeps working.
What you will see
- Header: the algorithm (alg), the token type and often a key id (kid) that tells a server which key to use.
- Payload: the claims. Registered claims like iss (issuer), sub (subject), aud (audience), exp, nbf, iat and jti are explained in plain language beside their values.
- Dates: exp, nbf, iat and auth_time are shown as readable UTC dates, and a banner tells you whether the token is expired, not yet valid or still good, with how long is left.
Checking a signature
Choose a token signed with HS256, HS384 or HS512 and paste the shared secret. The tool recomputes the HMAC with the WebCrypto API and compares it to the signature. Tick the Base64URL option if your secret is stored in that encoding. Tokens signed with RSA or ECDSA need a public key and are decoded but not verified here.
Debugging checklist
- Expired? Compare exp with the current time, and remember clock drift between servers can cause early failures.
- Wrong audience or issuer? Many APIs reject tokens whose aud or iss differ from what they expect.
- Algorithm confusion. Never accept alg none, and never let the token choose an algorithm your server does not expect.
- Sensitive data. Anyone holding a token can read the payload, so do not put passwords or private details in it.
- Short lifetimes. Keep access tokens short and use refresh tokens for longer sessions.
Tip
Copy the formatted header or payload with the copy buttons to paste into a bug report. Remove or mask the signature and any personal details first.
Frequently asked questions
Is it safe to paste my token here?
The decoding runs entirely in your browser and nothing is sent to DEV3 or anyone else. Even so, treat live production tokens as secrets and prefer test or expired tokens when you can.
Does decoding prove a token is valid?
No. Anyone can read a JWT payload; it is only encoded, not encrypted. Only checking the signature with the right key proves it was issued by the expected party and not altered.
Which signatures can I verify?
HS256, HS384 and HS512, which use a shared secret. RS256, ES256 and similar use a public key and are not verified here, but their header and payload are still decoded.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the earliest time it may be used. All three are Unix times in seconds, shown here as readable UTC dates.
Why does it say my token is malformed?
A JWT must have exactly three dot-separated parts: header, payload and signature, each Base64URL text. Look for stray spaces, missing dots or a copied "Bearer " prefix.
Can the payload be hidden?
A normal signed token (JWS) is readable by anyone. An encrypted token (JWE) has five parts and cannot be read without the key, so this tool will not decode it.