JWT Decoder
Read a token's header, claims and expiry — without handing anyone your signing key.
This reads a token. It cannot verify one.
A JWT is signed, not encrypted, so anyone holding it can already read the header and payload — that is all this page does, in your browser, with nothing sent anywhere. Checking the signature would need your signing key, and pasting a production key into any website is the one thing you should never do with it. Verify on your own server instead.
Expired 1 year ago.
alg HS256Claims
| subSubject | user_123 |
|---|---|
| name | Rabin Paudel |
| role | editor |
| iatIssued at | 17581536002025-09-18T00:00:00.000Z |
| expExpires | 17581572002025-09-18T01:00:00.000Z |
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "user_123",
"name": "Rabin Paudel",
"role": "editor",
"iat": 1758153600,
"exp": 1758157200
}Signature
not-a-real-signature
Shown as it is. Whether it is genuine can only be decided by whoever holds the key.
About this tool
Decode a JSON Web Token and read its header, payload and signature. Expiry, issued-at and not-before claims are shown as real dates with how long is left, and a token using alg:none is called out. It deliberately does not offer signature verification: that needs the key that signed the token, and no signing secret should ever be pasted into a website. Decoding happens in your browser and the token is never sent anywhere.
A JWT has three parts separated by dots: a header saying how it was signed, a payload of claims, and a signature over both. The first two are Base64URL-encoded JSON, not encryption, so anyone holding the token can already read them. That is what this page shows.
It deliberately does not offer to check the signature. Doing that needs the key that signed the token, and a site asking you to paste a production signing secret into a web form is asking for the one secret that should never leave your servers. Verify there, with your own library.
Treat a real token as a live credential while you are debugging. Anything in the payload is readable by whoever obtains it, so tokens do not belong in screenshots, bug reports or chat messages.