JWT Decoder
Decode a JSON Web Token, read its claims and expiry, and verify HS256 signatures with a secret.
Runs in your browser. Nothing is uploaded.
Token
Waiting for a token
The header, payload, and expiry appear here.
What this does
Paste a JSON Web Token and see its header and payload as readable JSON, plus when it was issued and when it expires, in UTC and relative to now. A Bearer prefix is ignored.
Checking the signature
Decoding a JWT does not prove it is genuine; anyone can read it. If the token uses HS256, HS384, or HS512, enter the shared secret and the signature is checked in your browser with the Web Crypto API. Tokens signed with RS256 or ES256 need the public key and are not verified here.
Privacy
Tokens and secrets never leave the page. Nothing is sent to a server or stored.