JWT Decoder
Decode JSON Web Tokens, read claims and expiry, and verify HS256 signatures locally.
The token never leaves the browser. Decoding and signature verification run entirely on this page; nothing is sent to any server.
Paste a JWT; it is decoded as you type. Ctrl/⌘ + Enter decodes immediately.
Claims
| Claim | Value | Meaning |
|---|
Verify signature (HS256 / HS384 / HS512)
Decode a token, enter the secret and press Verify. Only HMAC algorithms can be checked here.
What a JWT contains
A JSON Web Token is three Base64url strings joined by dots. The header names the signing algorithm and token type; the payload is a JSON object of claims saying who issued the token, who it is for and when it expires; the signature lets a server check that the first two parts were not altered. Decoding needs no secret, because Base64url is an encoding, not encryption. This decoder shows header and payload as formatted JSON, converts the iat, exp and nbf timestamps to your local time plus relative wording, and tells you whether the token has expired. With an HMAC token and its shared secret, you can also verify the signature here using Web Crypto.
Reading the claims
- exp, nbf and iat are Unix timestamps in seconds, judged against your device clock; servers usually allow a few seconds of skew, so a token that just expired here may still be accepted.
- iss is the issuer, sub the subject (usually the user ID), aud the intended audience and jti a unique token ID. Other claims are application-specific.
- Decoding is not validation: anyone can read a JWT, and only the signature proves it is genuine.
- HS256, HS384 and HS512 use a shared secret and can be verified here. RS256, ES256 and similar use a key pair, which this tool does not support.
- A token with alg "none" is unsigned; treat it as untrusted.
Privacy
Tokens are credentials: whoever holds one can act as its owner. That is why this page decodes and verifies locally and never transmits the token or the secret.