JWT Decoder

Decode a JSON Web Token to read its header and payload, see issue and expiry times, and verify HS256/384/512 signatures with a secret.

What is the JWT Decoder?

A JWT is a compact, signed token used for authentication. It has three Base64URL parts: header, payload (claims) and signature.

How does it work?

The header and payload are Base64URL-decoded and pretty-printed. If you enter the secret, the HMAC signature is recomputed with Web Crypto and compared.

Example

The jwt.io sample token decodes to {"sub":"1234567890","name":"John Doe","iat":1516239022}.

Frequently asked questions

Is it safe to paste production tokens here?

Decoding happens only in your browser. Still, treat live tokens like passwords and prefer expired or test tokens.

Does decoding prove the token is genuine?

No. Anyone can decode a JWT. Only signature verification with the correct key proves it was issued by the expected party.

Related tools

Enable JavaScript to use this calculator.