JWT Decoder
Decode a JSON Web Token’s header and payload and check its expiry. The signature is not verified.
Runs in your browser. Your input is processed on your device and is not uploaded to our server.
Decoding shows what a token claims; it does not prove the token is genuine. The token never leaves your browser.
Header
–
Payload
–
Verify an HMAC signature (HS256, HS384, HS512)
How to use the JWT Decoder
- Paste the JWT.
- Read the decoded header and payload, and the human-readable issued-at and expiry times.
- Optionally verify an HMAC (HS256/384/512) signature with a secret, entirely in your browser.
A JWT has three Base64URL parts: header, payload and signature. Decoding shows what the token claims, but decoding does not prove the token is genuine. Only verifying the signature with the right key does. This tool can verify HMAC signatures if you provide the secret; RSA and ECDSA tokens must be verified with the issuer’s public key in your application.
The token is processed only in your browser and never stored. Avoid pasting production tokens into any online tool you do not trust.
Frequently asked questions
Does “decoded successfully” mean the token is valid?
No. Anyone can create a token with any payload. Validity requires signature verification and checking claims such as exp, iss and aud.
What does alg: none mean?
An unsigned token. Applications must reject it unless they explicitly expect unsigned tokens.