About this tool
A JWT (RFC 7519) is three Base64url parts separated by dots: a header with the algorithm, a payload with the claims and a signature. Paste a token — with or without "Bearer" — to see the header and payload formatted, a table that explains each claim (iss, sub, aud, exp, iat, nbf, jti, scope…) and the time claims converted to dates, with a clear status: valid, expired or not valid yet. For HMAC tokens (HS256, HS384, HS512) type the secret to check the signature with Web Crypto; for RS256 and ES256 the tool decodes the token and explains that the check needs the public key. It also warns about alg "none". The token and the secret are never sent, saved or put in the link.
How to use it
- 1 Paste the token (the text after "Bearer" in the Authorization header also works).
- 2 Read the header and the payload, and the table explaining each claim.
- 3 Look at the status: valid, expired or not valid yet, with the dates in your time zone.
- 4 For HS256/384/512, type the secret to check the signature.
Frequently asked questions
Is it safe to paste a token here?
The decoding runs entirely in your browser: nothing is sent, logged or saved, and the token is never put in the address bar. Even so, treat production tokens like passwords — a valid token gives access until it expires.
Does decoding a JWT mean it is valid?
No. Anyone can read a JWT: the payload is only encoded, not encrypted. A server must check the signature and the exp, nbf, iss and aud claims before trusting it. This tool checks HMAC signatures when you give it the secret.
Why can it not check my RS256 token?
RS256 and ES256 are signed with a private key and checked with the public key of the issuer (often published as a JWKS). This tool decodes them and shows the claims; check the signature in your server or with the provider’s library.
Embed this tool
Add this free tool to your own website — copy the code below. It stays up to date automatically.
Tools for your site →