JWT decoder
Paste a JSON Web Token to read its claims, see when it expires and check its signature. Nothing leaves your browser.
Header
Verify signature
Paste a token to see which key it needs.
PEM (“BEGIN PUBLIC KEY”) or a JWK.
Payload
| Claim | Value |
|---|
Raw payload JSON
How a JWT is built
A JSON Web Token is three Base64URL strings joined by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. Times such as exp and iat are seconds since 1 January 1970, UTC.
Questions people ask
Is it safe to paste a real token here?
Decoding and verification run entirely in your browser with the Web Crypto API; the token and any key never leave this page. Even so, prefer expired or test tokens when you can.
Does decoding a JWT prove it is genuine?
No. Anyone can read a JWT’s header and payload, because they are only Base64URL-encoded. Only verifying the signature with the right secret or public key shows the token is genuine and unchanged.
Which algorithms can be verified?
HS256, HS384 and HS512 with a shared secret; RS256/384/512 and PS256/384/512 with an RSA public key; and ES256/384/512 with an elliptic-curve public key, as PEM or JWK.