The three parts of a JWT
The header and payload are only encoded, not encrypted. Anyone who has the token can read them, which is exactly what this tool does. The signature is what stops people changing them: without the secret or private key, any change makes the signature invalid.
Standard claims
| Claim | Meaning |
|---|---|
| iss | Issuer: who created the token |
| sub | Subject: usually the user ID |
| aud | Audience: which service the token is for |
| exp | Expiry time, as seconds since 1 January 1970 (Unix time) |
| nbf | Not valid before this time |
| iat | Issued at |
| jti | Unique token ID, used to block reuse |
The decoder converts exp, iat and nbf into readable dates in your time zone and tells you how long ago or how soon they are.
Signing algorithms
- HS256, HS384, HS512: HMAC with a shared secret. The same secret signs and verifies, so every service that checks tokens must keep it private. Paste the secret above to verify.
- RS256, PS256: RSA. The issuer signs with a private key; anyone can verify with the public key, often published at a JWKS URL.
- ES256: elliptic-curve signatures: like RSA but with shorter keys and signatures.
- none: no signature at all. Servers must never accept these.
Security checklist
- Never put secrets in the payload. Passwords, card numbers and private data are readable by anyone with the token.
- Always verify the signature on the server and fix the expected algorithm, rather than trusting the token's own
algheader. - Keep expiry short (minutes to an hour for access tokens) and use refresh tokens for longer sessions.
- Use a long random secret for HS256: at least 32 random bytes. The password generator can make one.
- Be careful where you paste tokens. A valid token works like a password until it expires. This page decodes locally, but you should still avoid pasting live production tokens into any third-party site.
The sample token above is generated in your browser and signed with the secret my-secret-key, so you can try verification.
Frequently asked questions
How do I decode a JWT?
Paste it in the box. The header and payload are Base64URL-decoded and shown as formatted JSON, with dates converted to readable times.
Is a JWT encrypted?
No. A standard JWT is only signed. Anyone can read its contents, so never store secrets in it. Encrypted tokens (JWE) have five parts instead of three.
How do I check if a JWT has expired?
Look at the exp claim. The decoder converts it to a date and shows whether the token has expired.
Can this verify the signature?
Yes, for HS256, HS384 and HS512 tokens: enter the shared secret. RSA and ECDSA tokens need the issuer’s public key.
Is my token sent to a server?
No. Decoding and verification happen in your browser with the Web Crypto API.
Last updated October 2026 · More developer tools