How to decode a JWT
- Paste the token (three Base64URL parts separated by dots) into the box.
- Read the decoded header and payload. Time claims are shown as dates in your time zone.
- Check the status: expired, valid, or not yet valid.
- To verify an HS256/HS384/HS512 signature, enter the secret and click Verify.
JWT structure and standard claims
| Part / claim | Meaning | Example |
|---|---|---|
| Header | Algorithm and token type | {"alg":"HS256","typ":"JWT"} |
| Payload | Claims about the user and the token | {"sub":"123","exp":1767225600} |
| Signature | Proves the header and payload were not changed | HMACSHA256(header.payload, secret) |
| iss / sub / aud | Issuer / subject (user) / audience | "https://auth.example.com" |
| exp / iat / nbf | Expiry / issued at / not before (Unix seconds) | 1767225600 |
Frequently asked questions
- Q. Is it safe to paste my JWT here?
- Decoding and verification run only in your browser, and nothing is sent to our server. Even so, treat production tokens like passwords: anyone who has a valid token can use it until it expires.
- Q. Is a JWT encrypted?
- No. A standard JWT (JWS) is only Base64URL-encoded and signed, so anyone can read the payload. Never put passwords or secrets in it. The signature only proves the token was not changed.
- Q. Why can't I verify RS256 or ES256 tokens?
- Those algorithms are verified with the issuer's public key, not a shared secret. This tool verifies HMAC algorithms (HS256, HS384, HS512) with the secret you enter.
- Q. What do exp, iat and nbf mean?
- They are Unix timestamps in seconds: exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted.
Related tools
- JSON FormatterFormat, validate and minify JSON with clear error messages. Runs in your browser.
- Base64 Encode / DecodeEncode text to Base64 or decode Base64 to text, with full UTF-8 and URL-safe support.
- Unix Timestamp ConverterConvert Unix timestamps (seconds or milliseconds) to dates and dates to timestamps.
- UUID GeneratorGenerate random UUID v4 or time-ordered UUID v7, one or many at once.
Last updated: