Decode a JWT without the secret
A JWT's header and payload aren't encrypted — they're just base64url-encoded JSON. That means you can read them without any secret or key, which is exactly what this decoder does. Paste the token and you'll see who it belongs to (sub), who issued it (iss), what it's for (aud) and any custom claims like email or role.
Reading a token is not the same as trusting it, though. Anyone can create a token with “role: admin” in it. Only the signature proves it came from your server — see “Verify the signature” below.
Check JWT expiration at a glance
The exp claim is a Unix timestamp, which isn't easy to read. This tool turns it into your local date and time and shows a live countdown: “Expires in 14 min 32 s”, “Expired 3 days ago”, or “Not valid yet” when the nbf (not before) time is still in the future.
Getting a “jwt expired” error from your API? Paste the token here to see exactly when it expired and compare it with your server's clock.
Verify the signature
To confirm a token is genuine, paste the shared secret (for HS256, HS384, HS512) or the issuer's public key in PEM format (for RS256, PS256 or ES256 and their 384/512 variants). Verification uses your browser's built-in Web Crypto API.
It also flags tokens with “alg: none” — unsigned tokens that anyone could forge — and recognises encrypted tokens (JWE), which can't be read without the decryption key.
Why decoding locally matters
A live access token is effectively a password. Pasting it into a site that sends it to a server is a real risk. This decoder works offline once the page has loaded: no request carries your token, your secret or your key. Open your browser's Network tab while you use it if you'd like to check.