JWT Decoder
Decode a JWT to inspect its header, payload and claims, and optionally verify the HS256 signature.
Paste a token above — it is decoded as you type, right here in your browser.
Header
Payload
Claims
Signature
How it works
A JSON Web Token is three base64url-encoded parts joined by dots:
header.payload.signature. Paste a token and this JWT decoder splits it,
base64url-decodes the header and payload, pretty-prints the JSON and translates the
registered time claims (iat, exp, nbf) into
readable UTC dates so you can see at a glance whether the token is still active or
expired. The header and payload are only encoded, not encrypted, so no secret is needed
to read them — that is exactly why you should never put passwords in a payload.
If you do have the signing secret you can check the signature too: the browser's built-in Web Crypto API recomputes the HMAC and compares it with the signature in the token. Everything — decoding and verification — happens locally in this page with JavaScript. Your token and your secret are never uploaded, logged or sent anywhere, which is the whole point: pasting a live access token into someone else's server is a real leak.
Frequently asked questions
Is it safe to decode a JWT online?
With this tool, yes: the decoding happens entirely in your browser with JavaScript, so the token is never sent to a server, logged or stored. That matters because most JWTs are live credentials — pasting an access token into a site that decodes it server-side effectively hands over the session. If you are unsure about any online decoder, check whether the page still works with your network disconnected; this one does.
Can you decode a JWT without the secret key?
Yes. A JWT's header and payload are only base64url-encoded, not encrypted, so anyone holding the token can read every claim inside it without any key. The secret is only needed to verify the signature — that is, to prove the token was issued by your server and has not been altered. This is exactly why you should never put passwords or other sensitive data in a JWT payload.
How do I check whether a JWT is expired?
Look at the exp claim, a Unix timestamp in seconds marking when the token stops being valid. This decoder converts exp, iat and nbf into readable UTC dates with a relative time, and shows a badge that reads Expired, Active or Not valid yet by comparing them with your device's clock — so you can tell at a glance whether a 401 came from an expired token.