JWT decoder
Read and verify a JSON Web Token
This JWT decoder shows the header and payload of a JSON Web Token, formats the claims and reads the issued-at and expiration dates. You can also verify the HMAC signature from a secret to confirm the token is authentic.
The token and secret never leave your browser: 100% local decoding and verification, no upload, no tracking and no ads.
FAQ
Is my token sent to a server?
No, decoding and verification happen only in your browser.
Which algorithms can the signature verify?
The HMAC algorithms HS256, HS384 and HS512 from a secret.
Does decoding reveal the token secret?
No, a JWT is not encrypted but the signing secret is never inside it.
How do I know if a token is expired?
The tool reads the exp claim and shows you the expiration date.