Skip to main content

JWT Decoder & Verifier

Paste a JSON Web Token to read its header and payload, see when it expires, and verify the signature with a secret or public key.

Runs 100% in your browser

Shortcuts
Copy the output
Alt + Shift + C

Your input is saved in this browser only. Reset clears it.

Decoding happens in your browser, and tokens and keys are never saved or put in links. A JWT payload is only Base64-encoded, not encrypted, so treat any token you paste anywhere as readable.

How to use the JWT Decoder

  1. Paste a JSON Web Token. A leading "Bearer " is fine.

  2. Read the decoded header and payload, with each registered claim explained and expiry times shown as real dates.

  3. To check the signature, paste the secret (HS256) or the issuer's public key, then select Verify signature.

Example: Decoding a signed access token

Token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzg4MTIiLCJuYW1lIjoiQWRhIExvdmVsYWNlIiwicm9sZSI6ImFkbWluIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLmV4YW1wbGUuY29tIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJpYXQiOjE3NTc4OTQ0MDAsImV4cCI6MTc1Nzg5ODAwMH0.mBKmzRXqcLV9mrcwneUe4e52S3G6IJ1TbR3g6kzq1Wk
Header and payload
{ "alg": "HS256", "typ": "JWT" }

{
  "sub": "user_8812",
  "name": "Ada Lovelace",
  "role": "admin",
  "iss": "https://auth.example.com",
  "aud": "https://api.example.com",
  "iat": 1757894400,
  "exp": 1757898000
}

The tool turns iat and exp into real dates and says whether the token is still valid. The signature of this sample verifies with the secret "devbottle-sample-secret".

Frequently Asked Questions

What is a JSON Web Token (JWT)?

A JWT is a compact, URL-safe token with three Base64URL-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims such as the subject and expiry, and a signature. It is most often used as a bearer token in an Authorization header to prove who a request comes from.

Is a JWT encrypted?

No. A standard JWT (a JWS) is signed, not encrypted. Anyone holding the token can Base64-decode the payload and read every claim, which is why tokens should never contain passwords or sensitive personal data. Encrypted tokens do exist (JWE, five parts instead of three), and their contents can only be read with the decryption key.

Is it safe to decode a JWT in an online tool?

Decoding here happens entirely in your browser: the token is never uploaded, saved, or added to shareable links. Even so, a token is a credential. If you paste a production token into any online tool, treat it as exposed and rotate it, and prefer a test token where you can.

How do I verify a JWT signature?

It depends on the algorithm in the header. HS256, HS384, and HS512 are symmetric: verification needs the same shared secret used to sign the token. RS256, PS256, and ES256 are asymmetric: you verify with the issuer's public key, usually published at a JWKS endpoint. Paste the secret or public key into the verification box to check the signature.

About JSON Web Tokens

A JSON Web Token is three Base64URL-encoded parts joined by dots: header.payload.signature. The header says which algorithm signed the token, the payload carries the claims, and the signature proves the first two parts haven't been changed. Because the parts are only encoded, not encrypted, anyone holding a token can read everything in it.

Tokens usually arrive in an Authorization: Bearer … header. How to Test a REST API Endpoint covers where that header fits when you're debugging an API, and Base64 Encoding: What It Is and When Developers Use It explains the encoding each part uses.

Decoding is not verifying

Reading a payload tells you what a token claims. It says nothing about whether those claims are trustworthy: anyone can craft a token with "role": "admin" inside. Only checking the signature against the signing key proves the issuer created it. Verify on the server, on every request, and check the expiry and audience as well as the signature.

Claims worth knowing

exp, nbf, iat

Expiry, not-before, and issued-at, all as Unix timestamps in seconds. This tool shows each one as a real date and how long is left.

iss and aud

Who issued the token and who it's for. An API should reject tokens issued for a different audience, even when the signature is valid.

sub

The subject: usually the user id the token represents. Custom claims such as roles or scopes sit alongside it.

alg

In the header. HS* algorithms use a shared secret; RS*, PS*, and ES* use a private key to sign and a public key to verify.

Common mistakes

  • Putting sensitive data in the payload. It's readable by anyone with the token.
  • Trusting the alg header. A library that accepts "none", or lets an attacker switch RS256 to HS256, can be tricked into accepting forged tokens. Pin the expected algorithm.
  • Long or missing expiry. Without exp, a leaked token works forever; short-lived access tokens plus a refresh token limit the damage.
  • Treating a JWT as a session you can revoke. Once issued, it stays valid until it expires unless you keep a denylist.

About pasting tokens anywhere

This decoder runs entirely in your browser: nothing is uploaded, saved, or added to shareable links. That still applies only to this page. Treat any production token you paste into a tool, chat, or ticket as exposed, and rotate it.