How to decode a JWT
- Paste your token.
- Read the header, payload and expiry.
- Optionally enter the secret to check an HS256 signature.
About this tool
Paste a JSON Web Token to read its header and payload and see when it expires. The token is decoded in this page and is never sent anywhere. Remember that decoding is not verifying: anyone can read a token, and only a signature check shows it is genuine. For tokens signed with a shared secret you can check the signature here with the Web Crypto API.
Common questions
Is it safe to paste a real token?
The decoding and the signature check run entirely in your browser and nothing is sent to a server. Still, treat live tokens as passwords and avoid sharing them.
Does decoding prove a token is valid?
No. Decoding only shows what the token says. Your server must verify the signature and check the expiry.
Which signatures can be checked?
HS256, HS384 and HS512, which use a shared secret. Tokens signed with a private key, such as RS256, need the public key and are not checked here.
Is it free to use?
Yes. There's no sign-up, and you can use it as often as you like.
Is my text uploaded anywhere?
No. This tool runs inside your browser, so what you enter stays on your device.
Do I need to install anything?
No. It works in your browser on a computer or a phone.