FREE TOOL
JWT decoder
Paste a token to see what is inside and whether it has expired.
Header
Payload
WHAT IT DOES
About this tool
Read the header, payload and claims of any JSON Web Token, see expiry times as readable dates and check HMAC signatures. Everything runs in your browser.
Everything runs right in your browser: your text and files are never uploaded or stored.
QUESTIONS
Frequently asked questions
Is it safe to paste a token here?
The token is decoded in your browser and never sent anywhere. Still, a valid token works like a password until it expires, so avoid pasting production tokens into any site you do not trust.
Does decoding verify the token?
No. Anyone can read the header and payload of a JWT. Only the signature proves they have not been tampered with. For HS256, HS384 and HS512 tokens, you can enter the secret below to check the signature.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued, and nbf is the time before which it should not be accepted. All three are Unix timestamps in seconds, shown here as readable dates.
06 / LET'S GET ACQUAINTED
TELL US
WHAT YOUR
BUSINESS NEEDS
Describe the task. Together we'll
work out the next step.