JWT decoder
{ "alg": "HS256", "typ": "JWT" }
{ "sub": "usr_8x42", "name": "Ada Lovelace", "iat": 1751961600, "exp": 1783497600 }
About JWT Decoder
The JWT decoder splits a JSON Web Token into its header, payload and signature and shows the header and payload as readable JSON. It reads the time claims, so you can see when the token was issued and whether it has expired.
If the token uses a shared secret (HS256, HS384 or HS512), you can enter the secret to check the signature with the Web Crypto API. The token and secret stay in your browser.
Use it to debug auth. Check which claims a token carries, confirm the issuer and audience, and find out why a request is rejected.
How it works
Base64url decoding
A JWT is three base64url segments joined by dots. Base64url uses - and _ instead of + and / and drops the padding. The decoder turns the header and payload back into JSON. Every JWT starts with eyJ because that is the base64url encoding of {", the start of the header.
Decoding is not verifying
Decoding shows what a token says. It does not prove who issued it. Anyone can create a JWT with any claims, so treat decoded values as untrusted until the signature is checked with the issuer's key. Make authorization decisions on the server.
Optional HMAC signature check
For HS256, HS384 and HS512 tokens, paste the shared secret and the tool recomputes the HMAC over header.payload with crypto.subtle. The secret is not sent anywhere. RS256, ES256 and other public-key algorithms need the issuer's public key and are not verified here. Use your JWT library or the issuer's JWKS endpoint for those.
Expiry and time claims
The time claims exp (expiry), iat (issued at) and nbf (not before) are NumericDate values, which are Unix timestamps in seconds. The decoder shows exp and iat as readable dates and marks a token expired when exp is in the past. nbf appears in the payload, and the timestamp converter can turn it into a date.
Registered claims explained
Besides the timestamps you will usually see iss (issuer), aud (audience), sub (subject) and jti (a unique token id, often used to block replay). These tell you who issued the token, who it is for and which user it represents. The header's alg and typ fields say how it was signed.
Frequently asked questions
Does decoding a JWT verify that it is valid?
No. Decoding only shows the claims. A forged or tampered token still decodes. For HS256, HS384 and HS512 you can enter the shared secret to verify the HMAC here. Verify RS256, ES256 and other public-key tokens in your own code with the issuer's public key.
What is a JWT deserializer or token inspector?
Both are other names for a JWT decoder. They base64url-decode the header and payload and show them as JSON. This one also shows the signing algorithm, the issued-at time and whether the token has expired.
Is it safe to paste a real access token here?
Decoding runs in your browser and the token is never uploaded. Still, treat any token you paste anywhere as possibly exposed, and rotate it if in doubt.
Should I paste my signing secret into the verifier?
Only if you are comfortable doing that on this device. The check runs locally and the secret is not sent anywhere, but a production signing secret is very sensitive. Prefer test secrets, and verify production tokens in your backend with a maintained JWT library.
How do I tell if a token is expired?
The decoder reads the exp claim, a Unix timestamp in seconds, and marks the token expired if that time has passed. It also shows iat, so you can see how long the token was meant to live.
Why won't my token decode?
A JWT needs three dot-separated base64url segments. Decoding fails if a part is missing, cut off or corrupted. Copy the whole token without line breaks and without a leading Bearer prefix. Encrypted tokens (JWE) have five segments and need the decryption key.
Learn more
Sources & last verified
We checked this tool's behavior and the claims on this page against the specifications below on . The tool runs in your browser, so the output you see is exactly what the engine produced.
- RFC 7519: JSON Web Token (JWT)
- RFC 7515: JSON Web Signature (JWS)
- RFC 4648: Base16, Base32 and Base64 encodings
Found a wrong result or an outdated claim? Report an error and we will check it again.
JSON Patch / Merge Patch
JSON Size Analyzer
Token Counter
OpenAPI Validator
CSV Validator
Kubernetes Manifest Validator