JWT Decoder
Decode a JSON Web Token and check when it expires — locally, in your browser
Header
Payload
Verify signature (HMAC)
About the JWT Decoder
A JSON Web Token is three Base64URL-encoded parts joined by dots: a header that names the signing algorithm, a payload of claims, and a signature. This decoder splits the token, turns the first two parts back into readable JSON and translates the time claims into dates, so you can see at a glance who issued a token, who it is for and whether it has expired.
Is it safe to paste a token here?
Decoding and verification happen entirely in your browser with the Web Crypto API; the token and secret are not sent anywhere. Even so, treat production tokens like passwords: anyone holding a valid token can use it until it expires.
Decoding is not decrypting
The payload of a standard signed JWT (JWS) is only encoded, not encrypted. Anyone can read it, which is why tokens should never carry passwords or other secrets. The signature only proves the payload has not been changed since it was signed.
exp, iat and nbf are Unix timestamps in seconds. "exp": 1767225600 means 1 January 2026, 00:00 UTC. A common bug is comparing them with JavaScript's Date.now(), which is in milliseconds.Which signatures can be verified?
HS256, HS384 and HS512 use a shared secret, so they can be checked here by entering that secret. RS256, ES256 and other asymmetric algorithms need the issuer's public key and are best verified in your backend or with the provider's JWKS endpoint. The decoder still shows their header and payload.