Security & Encoding
JWT Decoder
Paste a JSON Web Token to read its header, payload and registered claims. Decoding runs entirely in this page — your token is never sent anywhere.
Encoded token
header.payload.signatureA JWT has three dot-separated Base64URL parts. Decoding happens on this device and nothing is uploaded.
Paste a JWT above to decode its header and payload.
Payload
No payload decoded yet.
Header
No header decoded yet.
Signature
—
Claim breakdown
claimsVerify signature (optional) HS256 / HS384 / HS512
Verification uses HMAC in the Web Crypto API. The secret stays in this tab.
The built-in example is signed with your-256-bit-secret.
How it works
The header and payload are Base64URL-decoded and parsed as JSON in your browser. Decoding does not prove a token is genuine; use the optional signature check or your server to confirm authenticity. Never paste production secrets into a page you do not trust.
Practical uses
Base64URL-decode a JWT header and payload, parse them as JSON and break the payload into readable claims.
Common ways to use it
- Inspect the alg, typ and claims of a token issued by an authentication server.
- Read exp, nbf and iat as timestamps before debugging a rejected request.
- Decode a token copied from a log or bug report on your own machine.
Decode the built-in HS256 example
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Output
header {"alg":"HS256","typ":"JWT"}
payload {"sub":"1234567890","name":"John Doe","iat":1516239022}
HS256 · 3 claims decoded locally.
iat: 2018-01-18T01:30:22Z (Issued At)Verified with the tool's decode function and its built-in example token. Decoding is not validation: the signature is not checked, so the header and payload must be treated as untrusted text.
Options that matter
- Encoded token — the three-part Base64URL JWT; surrounding whitespace and line breaks are ignored.
- Load example / Clear — fill the input with the built-in HS256 token or reset it.
- Claim breakdown — registered claims such as exp, nbf and iat are shown as ISO timestamps with a relative description.
- Verify signature (optional) — computes an HMAC in Web Crypto for HS256, HS384 or HS512 only, given the secret; RSA, ECDSA and EdDSA tokens cannot be verified here.
Things to keep in mind
- Decoding alone does not verify the signature, so it does not prove a token is genuine and must not be treated as validation by a client or server.
- The optional signature check supports HMAC only (HS256, HS384, HS512); asymmetric algorithms are not supported.
- exp, nbf and iat are displayed as Unix seconds but the tool does not enforce them.
- The payload is not guaranteed to be a JSON object; a token with no exp or nbf is reported as having unknown temporal status.