JWT decoder
See what’s inside a token and whether it has expired, without sending it to anyone.
Runs entirely in your browser. Nothing you type is sent anywhere.
Header
Payload
Check the signature (HS256, HS384, HS512)
How to use the JWT decoder
A JWT has three parts: header, payload and signature. Anyone can read the first two, so never put secrets in a payload. The signature check works for HMAC tokens (HS256, HS384, HS512) when you know the secret.
- Paste the token. “Bearer ” at the start is removed automatically.
- Read the header, payload and expiry time.
- To check an HMAC signature, enter the secret and tap Check signature.
Questions
Is it safe to paste a real token here?
The token is decoded in your browser and never sent anywhere. Still, treat live tokens like passwords and avoid pasting them on shared computers.
Does decoding prove the token is genuine?
No. Anyone can read a JWT’s contents. Only a valid signature proves it came from the issuer.