JWT Decoder
Paste a JSON Web Token to read its header and claims, see exactly when it expires, and optionally verify the signature with your secret or public key — all offline.
Tokens are decoded and verified entirely in your browser with the Web Crypto API. Nothing you paste — token, secret or key — is sent anywhere or saved.
| Claim | Value | Meaning |
|---|
How it works
A JWT is three Base64URL strings joined by dots: a header (the signing algorithm), a payload (the claims) and a signature. The first two are only encoded, not encrypted — anyone holding the token can read them, which is exactly what this page does.
Time claims (exp, nbf, iat) are seconds since 1 January 1970 UTC. They are shown as dates in your time zone with a live countdown, so you can tell at a glance whether a token has expired.
Decoding proves nothing about who issued a token. To trust it you must verify the signature: with the shared secret for HS256/384/512, or the issuer’s public key (PEM or JWK) for RS, PS, ES and EdDSA tokens. Verification runs through your browser’s Web Crypto API.
Questions
Is it safe to paste a production token here?
Decoding happens locally and nothing is transmitted or stored, so the token does not leave your machine. Even so, treat live tokens like passwords: prefer expired or test tokens when you can, and never paste one into a site that sends it to a server.
Why does my token say “Invalid signature”?
The secret or key doesn’t match the one used to sign it, or the token was changed. For HS tokens, check whether the secret is stored Base64-encoded (tick the option). For RS/ES tokens, make sure you use the issuer’s public key whose kid matches the header.
Can a JWT be decoded without the secret?
Yes. The header and payload are plain Base64URL-encoded JSON. The secret is only needed to create or verify the signature. Never put confidential data in a JWT payload unless the token is encrypted (JWE).
What does alg “none” mean?
The token has no signature at all. Servers must reject such tokens; accepting them is a well-known vulnerability that lets anyone forge claims.
Where do I find the public key for my identity provider?
Most providers publish a JWKS (JSON Web Key Set) at a URL listed in their /.well-known/openid-configuration as jwks_uri. Open it, copy the JSON and paste it into the public key box — the key with the matching kid is picked automatically.