Inspect tokens safely
A JWT is three Base64URL parts separated by dots: a header, a payload of claims and a signature. Paste a token (a Bearer prefix is removed automatically) and the decoder shows the header and payload as formatted JSON, plus a table of standard claims with exp, iat and nbf converted to real dates and a clear message if the token has expired.
To confirm a token hasn't been tampered with, verify the signature: enter the shared secret for HS256/384/512, or the public key in PEM format for RS, PS and ES algorithms. Verification uses your browser's Web Crypto API, so secrets and tokens stay on your device — unlike pasting production tokens into random websites.
How to decode a JWT
- 1
Paste the token
From an Authorization header, cookie or log.
- 2
Read the header and payload
Claims are listed with readable dates.
- 3
Verify if needed
Add the secret or public key to check the signature.
Key features
Readable claims
exp, iat and nbf shown as dates with time remaining.
Signature verification
HS, RS, PS and ES algorithms via Web Crypto.
Expiry warnings
See at a glance whether a token is still valid.
Fully local
Tokens and keys are never uploaded.
Common uses
- Debugging authentication: Check which user, roles and scopes a token carries.
- Investigating 401 errors: Confirm whether a token has expired or has the wrong audience.
- Testing your auth server: Verify tokens are signed with the right key.
Tips and good to know
- Anyone can read a JWT's payload, so never put passwords or personal data in it.
- A token with
alg: noneis unsigned; your API should always reject it. - For other Base64 data, use the Base64 Decoder.