JWT Decoder
Decode a JWT to inspect its header, payload and claims, and optionally verify the HS256 signature.
Paste a token above — it is decoded as you type, right here in your browser.
Claims
Raw header & payload JSON
Header
Payload
Signature
How it works
A JSON Web Token is three base64url-encoded parts joined by dots:
header.payload.signature. Paste a token and this JWT decoder splits it,
base64url-decodes the header and payload, pretty-prints the JSON and translates the
registered time claims (iat, exp, nbf) into
readable UTC dates so you can see at a glance whether the token is still active or
expired. The header and payload are only encoded, not encrypted, so no secret is needed
to read them — that is exactly why you should never put passwords in a payload.
If you do have the signing secret you can check the signature too: the browser's built-in Web Crypto API recomputes the HMAC and compares it with the signature in the token. Everything — decoding and verification — happens locally in this page with JavaScript. Your token and your secret are never uploaded, logged or sent anywhere, which is the whole point: pasting a live access token into someone else's server is a real leak.
Frequently asked questions
Is it safe to decode a JWT online?
With this tool, yes: the decoding happens entirely in your browser with JavaScript, so the token is never sent to a server, logged or stored. That matters because most JWTs are live credentials, and pasting an access token into a site that decodes it server-side effectively hands over the session. If you are unsure about any online decoder, check whether the page still works with your network disconnected; this one does.
Can you decode a JWT without the secret key?
Yes. A JWT's header and payload are only base64url-encoded, not encrypted, so anyone holding the token can read every claim inside it without any key. The secret is only needed to verify the signature, that is, to prove the token was issued by your server and has not been altered. This is exactly why you should never put passwords or other sensitive data in a JWT payload.
How do I check whether a JWT is expired?
Look at the exp claim, a Unix timestamp in seconds marking when the token stops being valid. This decoder converts exp, iat and nbf into readable UTC dates with a relative time, and shows a badge that reads Expired, Active or Not valid yet by comparing them with your device's clock, so you can tell at a glance whether a 401 came from an expired token.