JWT Decoder & Inspector

Paste a JWT to read its claims, check when it expires, spot security problems and verify the signature.

  • Processed on your device
  • Instant, no queue
  • Free, no sign-up
Advertisement
Encoded token
Paste a token, or try the sample.

Verify signature

Paste a token to check its signature.

Headeralgorithm & token type 

        

        

          
Payloadclaims
            

          

        

        

          
Claims explained

          

        

        
    
      
    
    
    
  
    

  
  

    

    Advertisement
    How to use JWT Decoder & Inspector
    1. Paste a token into Encoded token. A Bearer  prefix is removed for you. Try Sample token to see how it works.
    2. Read the decoded Header and Payload. Claims explained turns exp, iat and nbf into real dates and describes each standard claim.
    3. To check the signature, enter the shared secret (HS256/384/512) or paste the public key as PEM or JWK (RS, PS, ES and EdDSA). Switch to Create token to sign your own test JWTs.
    About this tool
    A JSON Web Token (JWT) is a compact, URL-safe string made of three Base64URL parts separated by dots: a header that names the signing algorithm, a payload of claims about the user or session, and a signature. APIs and sign-in systems such as OAuth 2.0 and OpenID Connect use JWTs as access tokens and ID tokens.
    

    The header and payload are only encoded, not encrypted, so anyone holding a token can read them. That is why this inspector also warns you about common mistakes: tokens signed with alg: none, tokens without an expiry, very long lifetimes, times written in milliseconds instead of seconds, and claims that look like passwords or card numbers.
    

    Signature verification uses your browser's built-in Web Crypto API. For HMAC tokens enter the same secret the server used. For RSA, RSA-PSS, ECDSA and Ed25519 tokens paste the issuer's public key, or the whole JWKS from /.well-known/jwks.json; the key with the matching kid is picked automatically. Production tokens and secrets are safe to paste because nothing is sent to a server.
    Questions and answers
    Is it safe to paste a real token here?
    Yes. Decoding and signature checks run entirely in your browser with JavaScript and the Web Crypto API. The token, secret and keys are never uploaded. Still, treat live tokens like passwords and revoke any that may have leaked.
    Why does it say "Invalid signature"?
    Either the key does not match the one the issuer signed with, or the header or payload was changed after signing. For HS256 also check whether your secret is Base64 encoded and tick the box if it is.
    Can it decode encrypted tokens (JWE)?
    No. A JWE has five parts and its payload is encrypted, so it can only be read with the private key. The decoder tells you when you paste one.
    What do exp, iat and nbf mean?
    They are times in seconds since 1 January 1970. exp is when the token expires, iat is when it was issued and nbf is the earliest time it may be used. The inspector shows each as a local date and as "in 2 hours" or "3 days ago".
    Where do I find the public key to verify an RS256 token?
    Most identity providers publish a JWKS at https://<issuer>/.well-known/jwks.json. Open it, copy the whole JSON and paste it into the public key box.
    Can I create a JWT for testing?
    Yes. Switch to Create token, edit the header and payload JSON, enter a secret and copy the HS256, HS384 or HS512 token. Use Inspect to check it straight away.
    Advertisement