JWT Decoder
Paste a JSON Web Token to read its header and payload and see exp, iat and nbf as dates. You can check an HMAC signature (HS256, HS384, HS512) with your secret. Decoding happens in your browser; the token and secret are not uploaded, stored or put in the URL.
Runs in your browser
Free, no sign-up. Decoding and HMAC verification run in your browser. The token and secret are not uploaded, stored, placed in the URL or sent in analytics.
JWT Decoder
Decode a JWT in your browser and optionally verify HS256, HS384 or HS512 signatures with your secret.
Checked locally with your browser's Web Crypto. The token and secret are never uploaded or stored. RS256, ES256 and other public-key algorithms need a public key and are not verified here.
Status
Decoded
Algorithm
HS256
Type
JWT
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"iss": "smnify",
"sub": "user_123",
"name": "Zoë 山田",
"aud": "tools",
"role": "admin",
"userId": 1234567890123456789,
"iat": 1735689600,
"exp": 4102444800
}Registered claims
Issuer (iss)
smnify
Subject (sub)
user_123
Audience (aud)
tools
Expires At (exp)
Jan 1, 2100, 5:30:00 AM (in 73 years)
2100-01-01T00:00:00.000Z · 4102444800
Issued At (iat)
Jan 1, 2025, 5:30:00 AM (1 year ago)
2025-01-01T00:00:00.000Z · 1735689600
Signature
MKJvCG8O...416N9DOY
Need a custom internal tool or integration?
We build internal tools, APIs and integrations that fit your team's workflow, from a single admin screen to a full backend.
How to use the JWT Decoder
- Paste your token into the JWT input box, or press Sample to load a fake demo token. Clear empties the box and the secret.
- Read the decoded Header and Payload panels, and the validity status that compares exp and nbf with your current clock.
- Press Copy on a panel to copy it as JSON, or press the small Copy button on a single claim to copy just that value (time claims copy as ISO dates).
- To check the signature, enter the HMAC secret and choose how it is encoded, then read the verification result. Only HS256, HS384 and HS512 can be verified.
Worked example
Sample data
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzbW5pZnkiLCJzdWIiOiJ1c2VyXzEyMyIsIm5hbWUiOiJab8OrIOWxseeUsCIsImF1ZCI6InRvb2xzIiwicm9sZSI6ImFkbWluIiwidXNlcklkIjoxMjM0NTY3ODkwMTIzNDU2Nzg5LCJpYXQiOjE3MzU2ODk2MDAsImV4cCI6NDEwMjQ0NDgwMH0.MKJvCG8OXDUMx_tePtCv-R14_CFIJCssbG1416N9DOY
Header: {"alg":"HS256","typ":"JWT"}
Payload: iss smnify, sub user_123, name Zoë 山田, aud tools, role admin,
userId 1234567890123456789,
iat 1735689600 = 2025-01-01T00:00:00.000Z,
exp 4102444800 = 2100-01-01T00:00:00.000Z
Validity: Not expired
Signature with secret "smnify-demo-secret": verified (HS256)
Signature with secret "wrong": invalid, signature does not matchThis is a fake demo token, not a real credential. The 19-digit userId keeps every digit instead of being rounded by JavaScript. The decoder never needs the secret to read the claims; the secret is only used for the signature check.
How it works
What a JWT contains
A JSON Web Token is three base64url-encoded parts joined by dots: header, payload and signature. The header names the signing algorithm (alg) and token type. The payload holds claims such as iss (issuer), sub (subject), aud (audience), iat (issued at), nbf (not before) and exp (expires).
Base64url is an encoding, not encryption. Anyone holding the token can read the header and payload, so never put secrets in them.
Decoding is not verifying
Reading a token's claims tells you what it says, not whether it is genuine. Only a successful signature check against the right key shows the token was issued by the key holder and was not altered.
This tool verifies HMAC tokens (HS256, HS384, HS512) because a shared secret is all that is needed. Tokens signed with RS256, ES256 or similar need a public key, which this tool does not check, so they show as decoded only.
Your server must still validate the signature, algorithm, issuer, audience and expiry itself. A decoded token on this page is never proof of trust.
Time claims
exp, nbf and iat are NumericDate values: seconds since 1 January 1970 UTC. The tool shows each as an ISO date and compares exp and nbf with your device clock to report whether the token is expired or not yet valid.
If your clock is wrong the status will be wrong too. Servers normally allow a small clock-skew leeway that this status does not apply.
date = 1970-01-01T00:00:00Z + seconds
Privacy of tokens
Tokens are often live credentials. Here the token and secret are processed with your browser's own decoding and Web Crypto code. They are not sent to a server, written to storage, added to the URL or included in analytics events.
Still, treat production tokens with care: prefer expired or test tokens, and revoke any real token you pasted into a place you do not control.
Inputs, outputs and limits
Inputs
- A JWT with three dot-separated parts
- Optional HMAC secret, entered as text, with a choice of encoding
Outputs
- Decoded header and payload as JSON
- exp, nbf and iat as ISO dates plus an expired or not-yet-valid status
- Signature result: verified, invalid or not checkable
Limits
- Signature verification supports HS256, HS384 and HS512 only
- Tokens longer than 100,000 characters are rejected
- Five-part encrypted tokens (JWE) cannot be decoded, because the payload is encrypted
- Decoding does not prove a token is trusted
Processing
- Decoding and HMAC verification run in your browser. The token and secret are not uploaded, stored, placed in the URL or sent in analytics.
Frequently asked questions
Does decoding a JWT prove it is valid?
No. Decoding only reads the base64url text. A forged token decodes just as easily as a real one. Only a signature check with the correct key, plus your own checks of issuer, audience and expiry, shows a token can be trusted.
Is my token or secret sent anywhere?
No. Both are handled in your browser. They are not uploaded, saved to local storage, added to the page URL or included in usage analytics, which only record that a decode happened and never any values.
Which signature algorithms can I verify?
HS256, HS384 and HS512, which use a shared secret. RS256, ES256, PS256 and EdDSA tokens still decode, but checking them needs the issuer's public key, which this tool does not take.
Why does it say my token has five parts?
A five-part token is a JWE, an encrypted token. Its payload cannot be read without the decryption key, so it cannot be decoded here. A normal signed JWT has exactly three parts.
Why does a large number in my payload keep all its digits?
JavaScript rounds integers above 9,007,199,254,740,991. The decoder keeps the original digits of numbers in the payload so IDs such as 1234567890123456789 are shown as written.
Can I copy just one claim?
Yes. Each claim has its own Copy button. Time claims copy as an ISO date, other claims copy their value. The Header and Payload panels also copy as whole JSON.
Need a custom internal tool or integration?
We build internal tools, APIs and integrations that fit your team's workflow, from a single admin screen to a full backend.