How do I decode a JWT?

Paste the token into the input. The header and payload are decoded and formatted as you type, and the time claims are shown as readable dates.

Can anyone read the contents of my JWT?

Yes. The header and payload are only encoded, not encrypted, so anyone holding the token can read them. Never put passwords or other secrets in a JWT payload.

How do I verify a JWT signature?

For HS256, HS384 or HS512 tokens, enter the secret in the Signature section and choose whether it is plain text or Base64. The decoder signs the header and payload again with that secret and tells you whether the result matches the token's signature.

Why does my token say "Invalid signature"?

Either the secret is wrong, or it is in the wrong format. A secret your library decodes from Base64 has to be entered with Base64 selected, or the bytes will not match. A token that was edited after signing will also fail.

Is my token sent to a server?

No. Decoding and verification both run in your browser, so you can paste tokens from production without them leaving your device.

JWT Decoder

Read a token's header and claims, check its expiry and verify its signature. Everything runs locally with zero file uploads.

In: JWT
Out: Header · payload · signature check

Encoded token

HS256

Signature

Need a secret? Generate one

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "iat": 1767225600,
  "exp": 1893456000
}

Read a token without trusting it

A JWT is three Base64URL-encoded parts joined by dots: a header that names the algorithm, a payload of claims, and a signature over both. Anyone can read the first two, which is why a token must never hold anything secret, and only the signature proves the token came from someone who knows the key.

What the decoder shows

Header. The signing algorithm (alg) and token type, and sometimes a key ID (kid) that says which key signed it.
Payload. The claims: who the token is about (sub), who issued it (iss), who it is for (aud), and anything your application adds.
Times. iat, nbf and exp are seconds since 1970. The decoder shows them as dates in your time zone, and says whether the token has expired or is not valid yet.
Signature. For HS256, HS384 and HS512, enter the secret and the decoder recomputes the signature to tell you whether it matches. Tokens signed with RS, ES or PS algorithms decode as usual, but verifying them needs the issuer's public key.

Frequently asked questions

How do I decode a JWT?: Paste the token into the input. The header and payload are decoded and formatted as you type, and the time claims are shown as readable dates.
Can anyone read the contents of my JWT?: Yes. The header and payload are only encoded, not encrypted, so anyone holding the token can read them. Never put passwords or other secrets in a JWT payload.
How do I verify a JWT signature?: For HS256, HS384 or HS512 tokens, enter the secret in the Signature section and choose whether it is plain text or Base64. The decoder signs the header and payload again with that secret and tells you whether the result matches the token's signature.
Why does my token say "Invalid signature"?: Either the secret is wrong, or it is in the wrong format. A secret your library decodes from Base64 has to be entered with Base64 selected, or the bytes will not match. A token that was edited after signing will also fail.
Is my token sent to a server?: No. Decoding and verification both run in your browser, so you can paste tokens from production without them leaving your device.

The other tools

Data StudioMove structured text between JSON, YAML, TOML, CSV and Markdown.JWT Secret GeneratorRandom HS256, HS384 and HS512 secret keys in hex or Base64, ready for your .env.Password GeneratorStrong random passwords with the strength shown in bits.Mock Data GeneratorRealistic fake users, products and orders with your own columns, as JSON, CSV or SQL.Image ConverterRe-encode, resize and vectorise images with a live before/after.Compress & ArchiveShrink any file with gzip or Brotli, or bundle a folder into ZIP.DOCX to PDFTurn a Word document into a PDF with real, selectable text.PDF to DOCXRecover an editable Word document from a PDF's text layer.Background RemoverAutomatic AI cutout, macOS-style smart selection, and precision manual tools.PDF EditorSign documents, edit text, insert images, and whiteout PDFs directly in your browser.Case ConverterTurn text into kebab-case, camelCase, snake_case, Title Case and ten more cases.Lorem Ipsum GeneratorPlaceholder text by paragraphs, sentences or words, as plain text or HTML.Image to ASCIITurn a photo into ASCII art, in black and white or full colour.