JWT Decoder and Verifier
Decode a JSON Web Token, read its claims with dates in plain English, and verify an HS256 signature. Nothing is uploaded: tokens are credentials.
Token
Decoding happens in your browser. A token is a credential, so this matters more here than anywhere else on the site.
What this tool is for
Reads the header and payload of a token, explains the registered claims, and turns expiry and issue timestamps into readable dates. If you have the shared secret, it also checks the signature. Everything happens in your browser, and that matters more here than anywhere else on this site: a token is a live credential, and pasting one into a page that sends it somewhere is handing over an account.
How to use it
- Paste the token. A leading "Bearer" is fine, it gets stripped.
- Read the claims table: registered claims come with an explanation, and expiry is flagged if it has passed.
- To verify, paste the shared secret. The result says plainly whether the signature matches.
Frequently asked questions
Is a JWT encrypted?
No. The header and payload are Base64url, not encryption: anyone holding the token can read every claim in it. Never put anything secret in a payload. What the signature protects is integrity, not confidentiality.
What does a valid signature actually prove?
That the token was created by someone holding the key and has not been altered since. It says nothing about expiry, revocation or whether the token was meant for your service, which is why exp, aud and iss still have to be checked.
Why can it not verify my RS256 token?
RS and ES algorithms sign with a private key and verify with a public one, so verification needs the issuer public key in JWK or PEM form rather than a shared secret. HS256, HS384 and HS512 use one shared secret and can be checked here.
Is it safe to paste a production token here?
The decoding runs in your browser and nothing is transmitted. Even so, treat any live token as a password: prefer an expired or test token when you only need to see the structure.