JWT decoder
Paste a JWT to read its header and payload, see when it expires, and optionally verify the signature with a secret or public key.
No uploads · Everything runs in this browser
Decoding only reads the contents. It does not prove the token is genuine.
Header
Payload
Times
| Expires (exp) | |
|---|---|
| Not before (nbf) | |
| Issued (iat) |
No exp, nbf or iat claims.
Verify signature (optional)
FAQ
Is it safe to paste a production token?
The token is decoded and verified only inside this browser and is never sent anywhere. Still, treat live tokens like passwords and avoid sharing your screen while they are visible.
Does decoding prove a token is valid?
No. Anyone can read a JWT. Only a signature check with the right secret or public key shows that the token has not been altered.
Which keys can I use for verification?
HS256/384/512 use a shared secret. RS, PS, ES and EdDSA use a public key in PEM (BEGIN PUBLIC KEY or BEGIN RSA PUBLIC KEY) or JWK/JWKS format.