JWT Decoder Online - Decode & Verify JSON Web Tokens

Paste a JSON Web Token to read its header, payload and claims, see exactly when it expires, and optionally verify an HMAC signature. Everything runs in your browser.

Last updated: April 2026

Your token never leaves this page. Decoding and signature verification run locally in your browser using JavaScript and the Web Crypto API. Nothing is uploaded, logged or stored. Open your browser's network tab while you decode and you will see no request go out.

How to Decode a JWT

  1. Copy the token. It is three base64url segments separated by dots: header.payload.signature.
  2. Paste it into the box above and press Decode Token.
  3. Read the header to see the signing algorithm, and the payload to see the claims.
  4. Check the expiry row. An expired token is the most common cause of a sudden 401.
  5. If the token uses HS256, HS384 or HS512 and you have the secret, verify the signature.

What a JWT Actually Contains

A JSON Web Token is not encrypted. It is three pieces of base64url encoded text joined by dots, and the first two are plain readable JSON to anyone who has the token. The signature is what makes a JWT trustworthy, and it can only be checked by whoever holds the key.

  • Header declares the signing algorithm (alg) and token type (typ). A kid value points at which key was used.
  • Payload carries the claims. RFC 7519 registers iss, sub, aud, exp, nbf, iat and jti; everything else is yours.
  • Signature is computed over the first two segments. Without the key it can be read but not recreated.

Because the payload is readable, never put anything secret in it. A JWT is a signed statement, not a sealed envelope.

Frequently Asked Questions

Is it safe to decode a JWT online?

On this page, yes. Decoding happens entirely in your browser and the token is never sent to a server, never logged and never stored. You can confirm this by opening your browser's network tab while decoding: no request is made. Even so, treat any JWT you hold as a live credential, and prefer an expired or test token when using any online tool.

Does decoding a JWT mean it is valid?

No. The header and payload are only base64url encoded, not encrypted, so anyone can read them without a key. Decoding proves nothing about authenticity. A token is only trustworthy once its signature has been verified against the issuer's secret or public key, and the exp, nbf, iss and aud claims have been checked.

Can I verify the signature of a JWT here?

You can verify HMAC signatures (HS256, HS384 and HS512) by entering the shared secret. Verification uses the browser's built-in Web Crypto API, so the secret also stays on your machine. RSA and ECDSA tokens (RS*, PS*, ES*) are decoded and their algorithm is shown, but signature verification for those is not offered here.

Why does my token show as expired?

The exp claim is a Unix timestamp in seconds, not milliseconds. A token generated with a millisecond timestamp pushes the expiry thousands of years into the future, which is a common bug. This decoder shows the exact date it read so you can spot that immediately.

What do the standard JWT claims mean?

iss issuer, sub subject (usually the user id), aud audience, exp expiry time, nbf not valid before, iat issued at, jti unique token id. All are optional; any other claim is application specific.