JWT Decoder

How to use

This tool decodes JSON Web Tokens (JWTs), the signed tokens many websites and APIs use to prove who you are.

1. Paste a token into JSON Web Token. You can paste it with a Bearer prefix or across several lines; the extra parts are removed. Press Load an example to try it with a sample token.
2. The token is shown again with its three parts in colour: the header, the payload and the signature.
3. Header and Payload show the decoded JSON, ready to copy. Large numbers stay exact.
4. Claims explains the standard fields. exp shows when the token expires and whether it already has. nbf shows when it starts being valid, and iat when it was issued. Issuer, subject, audience and token ID are listed too.
5. Anything unusual appears under Check this. That includes unsigned tokens (alg: none), missing signatures and dates in the future.

To check the signature, use Verify the signature. For HS256, HS384 and HS512, enter the shared secret, and change Secret format if it's stored as Base64. For RS, PS, ES and EdDSA tokens, paste the issuer's public key: PEM, a certificate, a JWK or a whole JWKS. The result says whether the token was really signed with it.

Edit and sign with a secret makes a new token from a changed payload, for testing your own app.

Decoding is not the same as trusting. Anyone can read a JWT, because the payload is only encoded, not encrypted. Only a matching signature shows that it hasn't been changed.

Tokens often grant access to accounts, so treat them like passwords. This page decodes and checks them in your browser. The token and secret are never sent anywhere, and the secret is never saved.

Frequently asked questions

Is it safe to paste my JWT here?

The token is decoded and checked in your browser with JavaScript, and nothing is sent to a server. Even so, treat live tokens like passwords and avoid sharing screenshots of them.

Can anyone read the contents of a JWT?

Yes. The header and payload are only base64url encoded, so anyone with the token can read them. Never put secrets in a JWT payload. The signature stops changes, not reading.

How do I check an RS256 or ES256 token?

Paste the issuer's public key under Verify the signature. Most issuers publish their keys as a JWKS, at an address ending in /.well-known/jwks.json. Open it, copy all of it and paste it here. The tool picks the key by the token's "kid".