What it does
A JSON Web Token carries its data in plain sight: the header and payload are only Base64URL-encoded, not encrypted. This tool decodes them, shows the standard claims such as the issuer, subject and expiry in readable dates, and tells you whether the token is still valid. To prove the token is genuine, check its signature with the shared secret (HS256, HS384, HS512) or the issuer’s public key (RS, PS and ES algorithms). Tokens are credentials, so it matters where you paste them: here, decoding and verification run entirely in your browser, and nothing is sent anywhere.
How to use it
- Paste the token into the box. A “Bearer ” prefix, quotes or line breaks are cleaned up for you.
- Read the decoded header and payload, and the standard claims with their dates in your time zone. The status line tells you whether the token has expired.
- To check the signature, enter the secret (for HS256 and similar) or paste the public key (for RS256, PS256 or ES256), then click “Check signature”.
Common uses
- Finding out why an API returns 401: an expired token, the wrong audience or a missing role
- Checking which claims your login provider puts in its ID and access tokens
- Confirming that a token was signed with the key you expect before trusting it in your code
Tips
- Never put passwords or other secrets in a JWT payload: anyone holding the token can read it.
- JWT times (exp, iat, nbf) are in seconds since 1 January 1970, not milliseconds.
- A valid signature only proves who signed the token. Your server still has to check exp, the issuer and the audience.