JWT Decoder
Decode a JWT's header and payload, check its expiration, and verify HMAC signatures.
no expiry— This token has no "exp" claim, so it never expires.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}Claims
sub"1234567890"name"John Doe"iat1516239022Verify Signature
About JWT Decoder
This tool decodes a JSON Web Token (JWT) into its header and payload, so you can inspect the algorithm, claims, and expiration status without leaving your browser. Standard claims (iss, sub, aud, exp, nbf, iat, jti) are explained in plain English, and the expiration status is checked automatically against your device's clock. If the token uses an HMAC algorithm (HS256, HS384, or HS512), you can also verify its signature against a shared secret — useful for confirming a token was actually issued by your own backend and hasn't been tampered with. RSA/EC-signed tokens (RS256, ES256, etc.) can be decoded but not verified here, since those require a public key rather than a shared secret. Nothing is ever sent to a server — decoding and verification both happen locally using your browser's built-in Web Crypto API, so it's safe to paste real tokens, including ones from production systems.
Read the full JWT guideFrequently Asked Questions
Yes — this tool runs entirely in your browser. The token, and any secret you enter to verify a signature, are never sent to a server or logged anywhere.
Those algorithms are signed with a private key and verified with a matching public key, not a shared secret. Verifying them would require pasting in the issuer's public key (JWK or PEM) — decoding still works fine, only signature verification is limited to the HMAC family (HS256/HS384/HS512) here.
A JWT's signature only proves the token wasn't tampered with — it says nothing about whether the token should still be accepted. The "exp" claim is a separate, self-reported expiration time that your server is expected to check independently.
No. Decoding just reads the base64url-encoded header and payload — anyone can decode a JWT without knowing its secret. Only the signature verification step actually confirms the token is authentic.