JWT Decoder

Paste a JSON Web Token to read its header and claims, see when it expires, and check its signature with your secret or public key.

Text

Encoded

Make a header

Username or API key Password or secret

Header

Value

Base64 only

Read a header

Authorization header or its Base64

Username

Password

Token

Empty

Check the signature

Not checked

Secret The secret is Base64-encoded

Header

Payload

Times and claims

Message

Signature

SHA-256 hash

Algorithm Key is

Secret key — leave empty for a plain hash

Hex

Base64

Compare with a signature you received

Questions

Why can it read a token without the secret?

A JWT's header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them. The signature is what proves the token wasn't changed, and checking it needs the secret or the public key.

Which signatures can it check?

HS256, HS384 and HS512 with the shared secret; RS256, RS384, RS512, PS256, PS384 and PS512 with an RSA public key; and ES256, ES384 and ES512 with an EC public key — as PEM (-----BEGIN PUBLIC KEY-----) or as a JWK.

Is it safe to paste a real token?

The token is decoded in your browser and never sent or saved. Still, treat a live token like a password: anyone who has it can use it until it expires.

JWT Decoder

Text

Base64

Text

Encoded

URL parts

Make a header

Read a header

Token

Check the signature

Header

Payload

Times and claims

Message

Signature

How to use the JWT Decoder

Questions