JWT Decoder
JWT Decoder reads the header and payload of a JSON Web Token, shows its claims and expiry, and can verify an HS256 signature if you supply the secret. Decoding needs no key at all, because a JWT is signed rather than encrypted — anyone holding one can read it.
Runs entirely in your browser — nothing you enter is uploaded.
DeveloperYour token never leaves this page. Decoding happens in your browser. A JWT is a credential — anyone who has it can act as you until it expires, so pasting one into a site that uploads it is a real risk. Prefer an expired or test token wherever you can.
A JWT is signed, not encrypted. The payload is base64url — readable by anyone holding the token, including whoever it was issued to. Never put a password, a card number or anything else private in one.
About JSON Web Tokens
A JWT is three base64url segments separated by dots: a header saying how it was signed, a payload of claims, and a signature over the first two. The signature proves the token was issued by someone holding the secret and has not been altered — it does not hide anything. The payload is readable by anyone with the token, which is why a password or a card number must never go in one.
The registered time claims are seconds since the Unix epoch, not
milliseconds; passing exp straight to a date function without
multiplying by a thousand produces January 1970, and is the most common JWT
bug after assuming encryption. Because a token is validated by checking a
signature rather than by a database lookup, there is nothing to revoke — which
is why access tokens are given short lifetimes and paired with a refresh token
that is checked.
Common questions
- Is a JWT encrypted?
- No. A standard JWT is signed, not encrypted. The header and payload are base64url-encoded, which is an encoding rather than a cipher, so anyone holding the token can read them without any key. The signature only proves the token is genuine and unaltered. Never put anything confidential in a payload.
- Can I decode a token without knowing the secret?
- Yes, and that is by design — decoding needs no key because the payload is only encoded. The secret is required for one thing only: checking that the signature matches, which proves the token was issued by whoever holds that secret. Being able to read a token is not evidence that anything has been compromised.
- What do exp, iat, nbf, sub and iss mean?
- They are the registered claims. exp is when the token expires and nbf the time before which it must be rejected; iat records when it was issued. sub identifies the subject, usually the user, and iss the issuer that created it. All three time claims are counts of seconds since the Unix epoch, not milliseconds.
- Is it safe to paste a token here?
- The decoding happens entirely in your browser and the token is never transmitted, which is precisely why this tool exists — many online decoders upload what you paste. Even so, a live token is a credential that lets anyone act as you until it expires, so prefer an expired or test token when you can, and treat any token pasted anywhere as worth rotating.