JWT Decoder
Free JWT decoder. Inspect header and payload, see expiry in plain language and verify HS256/384/512 signatures. Tokens stay in your browser — never uploaded.
- No upload — 100% private
- Instant, on your device
- Free, no sign-up
- Works offline once loaded
How it works
How to use JWT Decoder
Paste a JWT — a leading 'Bearer ' is removed automatically.
Read the colour-coded header, payload and signature parts.
Check issued-at, not-before and expiry times with an Expired or Active badge.
To verify an HS256, HS384 or HS512 signature, enter the shared secret.
Why use it
Why use our JWT Decoder tool
Instant decoding
Header and payload are shown as formatted JSON with one-click copy.
Readable timestamps
exp, iat, nbf and auth_time in your local time with 'in 2 hours' or '3 days ago'.
Expiry badge
See at a glance whether a token is active, expired or not yet valid.
Signature verification
Verify HMAC-signed tokens with a UTF-8 or Base64 secret using the Web Crypto API.
Never leaves your browser
Tokens are decoded locally — unlike many online decoders, nothing is sent to a server.
FAQ
Frequently asked questions
Is it safe to paste a production JWT here?
Decoding happens entirely in your browser with JavaScript — the token is never sent over the network. Still, treat live tokens like passwords and revoke any you have exposed.
Does decoding a JWT prove it is valid?
No. Anyone can decode a JWT because the payload is only Base64URL-encoded. Only signature verification proves the token was issued by someone holding the key.
Can I verify RS256 or ES256 tokens?
This tool verifies HMAC algorithms (HS256, HS384, HS512) with a shared secret. RS and ES tokens are decoded and inspected, but verifying them requires the issuer's public key.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is the time before which it must not be accepted. All are Unix timestamps in seconds.
Why is my token showing 'Expired'?
Its exp time is earlier than your device's current clock. If it should still be valid, check that your computer's date and time are correct.
Related tools
Base64 Encode & Decode
Encode or decode Base64 text, files, images and data URIs.
JSON Formatter
Beautify, validate, minify and explore JSON as a tree.
Unix Timestamp Converter
Convert epoch timestamps to dates and back in any time zone.
Hash Generator
MD5, SHA-1, SHA-256, SHA-512 and HMAC for text or files.
URL Encode & Decode
Percent-encode, decode and edit URL query parameters.
UUID Generator
Generate v4 and v7 UUIDs in bulk, then validate and decode.
Regex Tester
Test JavaScript regular expressions with live highlighting.
Diff Checker
Compare two texts side by side with word-level highlights.