How to use JWT decoder and verifier
- Paste the token. A leading Bearer is fine.
- Read the header, payload, and the expiry and issue times in plain dates.
- For HS256, HS384 or HS512 tokens, enter the secret and select Verify signature.
What's inside a JWT
A JSON Web Token has three parts separated by dots: a header saying how it was signed, a payload of claims such as the user ID and expiry time, and a signature. The first two are only Base64URL-encoded JSON, so anyone holding the token can read them. This tool decodes them and pretty-prints the JSON.
Time claims are numbers of seconds since 1970, which are hard to read. The tool turns exp, iat, nbf and auth_time into real dates and tells you how long ago or how far in the future each one is, and whether the token has expired.
Checking the signature
Decoding proves nothing about whether a token is genuine, because anyone can create a token with any payload. Only the signature does. For tokens signed with HMAC (HS256, HS384 or HS512), enter the shared secret and the tool verifies the signature with your browser's WebCrypto. A match means the token was signed with that secret and hasn't been changed since.
Tokens signed with RSA or elliptic-curve keys (RS256, ES256 and similar) are decoded, but checking them needs the issuer's public key, which this tool does not support yet.
Tokens are credentials
A valid token lets whoever holds it act as the user until it expires. This tool decodes and verifies in your browser; neither the token nor the secret is sent anywhere or saved. Even so, prefer test tokens, and rotate any production token or secret you have pasted into a website, this one included.
Common uses
Checking why an API returns 401 (often an expired token or the wrong audience claim), confirming which scopes or roles a token carries, verifying a webhook's signed token with your shared secret, or reading the claims an identity provider such as Auth0 or Supabase puts in its tokens. Paste the token with or without the Bearer prefix, and with any surrounding spaces.
Questions
- Is it safe to paste a real token here?
- The token is decoded in your browser and never sent anywhere or saved. Still, a live token is a credential: prefer test tokens, and rotate any production token you've pasted into a website.
- Does decoding prove a token is genuine?
- No. Anyone can read a JWT's contents. Only verifying the signature with the right key proves it hasn't been altered.
- Which signatures can it verify?
- HMAC tokens (HS256, HS384, HS512) with a shared secret, using your browser's WebCrypto. RS and ES tokens are decoded but not yet verified.