Start a project

Tool 45 of 57 · Security

JWT Decoder

Paste a JSON Web Token to read its header and payload, see when it expires in plain English, and check an HS256 signature, without it leaving your browser.

Use the tool All developer tools Live · free
JWT Decoder at a glanceIllustration: 1, A token; 2, processed in your browser; 3, Claims + signature.JWT Decoder</>1A token3Claims + signature2In yourbrowser
1 A token 2 processed on your device 3 Claims + signature

JWT Decoder

Your token

Decoded in this browser only. Still, don't paste live production tokens into any website you don't control.

Header and payload

Header
Payload

Claims and signature

    Checked with WebCrypto in this browser

    01

    What it does

    Decodes JSON Web Tokens in your browser, explains the claims and expiry, and checks HMAC signatures.

    • Header, payload and signature colour coded
    • Dates in exp, iat and nbf shown in your time zone
    • Expired and not-yet-valid tokens flagged
    • HS256, HS384 and HS512 signature check

    02

    Private by design

    Everything happens in your browser. Nothing you type, paste or upload is sent anywhere, and it keeps working offline once the page has loaded.

    03

    What you get

    Header and payload JSON, with a Copy and a Download button on every result.

    • JWT
    • Auth
    • Debugging

    Why it matters

    Login systems, APIs and many SaaS integrations pass JSON Web Tokens around. When something fails ('401 Unauthorised'), the first question is what's inside the token and whether it's expired.

    Pasting a token into a random website is a risk, because a token is a key. This decoder works entirely in your browser, and it can also check an HMAC signature with WebCrypto so you know the token wasn't altered.

    How it works

    1. InputA JSON Web Token
    2. In your browserSplit and Base64url-decoded, HS signatures checked
    3. OutputHeader, payload, readable times and a signature result

    Where it fits in a designer's workflow

    1. Plan
    2. Design
    3. Build
    4. Test
    5. Launch
    Debugging logins and API authentication.

    By the numbers

    The sample token, part by partHeader: 36 chars; Payload: 122 chars; Signature: 43 charsHeader36 charsPayload122 charsSignature43 chars
    Counted from this tool's example token. The header and payload are only Base64url-encoded, not encrypted: anyone holding a token can read them, so never put secrets in a JWT payload. The signature proves the first two parts haven't been changed. Source: RFC 7519: JSON Web Token.
    Show the numbers as a table
    PartCharacters
    Header36
    Payload122
    Signature43

    How to use it

    1. Paste the token.
    2. Read the header, payload and claims.
    3. To check the signature, enter the secret (HS256/384/512 only).
    4. Copy or download the decoded parts.

    FAQ

    Is it safe to paste a token here?

    It's decoded locally and never sent, but good practice is to use test tokens, or tokens that have already expired.

    Can it check RS256 tokens?

    Not yet. RSA and ECDSA tokens need the issuer's public key; the decoder still reads them.

    Is the payload secret?

    No. A JWT is signed, not encrypted: anyone with the token can read the payload. Don't put secrets in it.

    Why is alg none dangerous?

    It means no signature, so anyone could have written the token. Servers should always reject it.

    Work with me

    Want a site that gets these right?

    I build fast, accessible websites and web apps that pass these checks from day one. Tell me about your project and I'll reply personally with honest next steps.

    Start a project What I do

    All developer tools · Back to leej.uk