JWT Decoder
Decode a JWT to read its header, payload and expiry, and verify the signature if you add a key. Nothing you enter is sent to a server.
Loading the tool…
User reviews
No reviews yet. If you’ve used this tool, be the first to leave one.
JWT Decoder: complete guide
Walk through the steps and examples, or jump straight to the topic you need.
At a glance
- What it handles
- The header and contents of a three-part token separated by dots (JWS).
- Signature check
- Enter a secret key (HS) or a public key (RS, PS, ES, EdDSA, PEM or JWK) and it's checked inside the browser.
- Time display
- Converts exp, iat and nbf into dates a person can read.
- Validity
- Compares with the current time to tell expired, valid and not yet valid apart.
- Field names
- Gives plain-language names to known fields such as issuer and audience.
- Risk warning
- Gives a separate warning if the signing method is none.
- Not covered
- Five-part encrypted tokens (JWE).
- Where it runs
- The token isn't sent to a server and is read only in this browser.
How to use JWT Decoder
Paste the token
Just paste the string that starts with eyJ. If it has a Bearer prefix, that's removed automatically. You can also press Insert example to see the form first.
Check the validity period
At the top you'll see the signing method and the validity period. If it has expired, you're told how long ago, and if not yet, when it ends. After some time has passed, press the button to view again at the current time.
Look at the contents
The values the token carries are shown in a table. Time fields have the date next to them, and the original JSON is also below as is, so you can copy it.
Enter a key to check the signature
In the signature check box, enter the secret key for an HS token or the public key for an RS, PS or ES token, and it tells you right away whether the signature matches. If the secret key is written in base64, turn on that option. The key isn't saved.
What it’s good for
Turn the expiry time into a date a person can read
The exp, iat and nbf values in a JWT are written as seconds since 1970, so they're hard to read as they are. This tool converts them to dates and times, compares them with the current time, and tells you whether the token has already expired, is still valid, or ends in how many minutes. Known fields such as issuer and audience get plain-language names, which makes even an unfamiliar token easy to understand.
The signature is checked only when you enter a key
To confirm a token is genuine, you need the issuer's secret key or public key. Enter the secret text for HS256, 384 and 512, or a public key as PEM or JWK for RS, PS, ES and EdDSA, and the WebCrypto built into your browser tells you whether the signature matches. The key is used only for the check and is never saved or sent. If you enter a private key or a certificate, it tells you rather than checking, and it rejects the algorithm-confusion pattern of entering a public key for an HS token. Tokens whose signing method is none get a clear warning.
Worked examples
An expired token
A token whose exp has passedValidity: Expired
This token has already expired. It expired 3 hours ago.A token whose signing method is none
A token with alg set to noneThe signing method is none. This token has no signature, so anyone can change its contents.What this tool does and doesn't do
Swipe the table sideways to see the rest.
| Item | Here | Why |
|---|---|---|
| Reading the contents | Yes | Tokens are designed so that anyone can decode them. |
| Checking expiry | Yes | All it takes is the exp value and the current time. |
| Checking the signature | Yes, if you enter a key | The key is used only for the check and is never saved or sent. Private keys are not accepted. |
| Creating a token | No | Signing requires a key. |
When the result isn’t what you expected
It says the token doesn't have three parts
Part of it may have been missed when copying. Check that there are two dots (.) and that the start and end haven't been cut off.
It says it isn't JSON
It may be a string other than a JWT. A value that's only base64-encoded isn't a JWT. In that case, try the Base64 converter.
It says there's no expiry time
The token doesn't include exp. It may never expire, or the server may manage that separately, so this token alone isn't judged.
Korean text looks garbled
It isn't garbled. It's read as UTF-8, so Korean values such as names come through as they are. If it looks different, the token itself is encoded in another way.
Key terms
- JWT
- A token that joins a header, contents and a signature with dots. Widely used to carry sign-in state.
- payload
- The values the token carries. Anyone can decode it, so don't put secrets in it.
- exp
- The expiry time. Written as seconds since 1970.
- alg
- The method used to sign. none means there is no signature.
JWT Decoder FAQ
Is my token sent to a server?
No. Reading and decoding all happen inside this browser. Real tokens, though, contain sign-in information, so on someone else's computer, clear the input box after you check.
Does it check whether the signature is valid?
It does when you enter a key. For HS methods enter the secret key, and for RS, PS, ES and EdDSA methods enter the public key (PEM or JWK). If you don't enter a key, it only decodes and shows the contents and doesn't judge whether the token is genuine. Avoid entering a secret key used in production and use a test key instead.
Does it work with encrypted tokens?
No. A five-part JWE has encrypted contents that can't be read without the key. If you enter such a token, it tells you it's a JWE.
Is there a password in the token?
There shouldn't be. Anyone can decode the contents, so it isn't encryption. If you check with this tool and see a sensitive value, that itself is the problem.
It has expired but I'm still signed in
That's the case when the server issued a new token or keeps state some other way. This tool judges only the one token you entered.
Can I enter someone else's token?
Technically it can be read, but it's handling another person's sign-in information. Use only your own token or a test token.