JWT Decoder
Guide: HTTP Status Codes Explained: The Ones You Actually Need
Nothing you enter or choose here leaves your device. This tool runs in your browser.
How to use
- 1Paste your JWT into the box. A leading "Bearer " is removed for you.
- 2Read the decoded header and payload, and whether the token is expired.
- 3Check the issued, expiry and not-before times in plain dates.
- 4Enter the secret to check an HS256, HS384 or HS512 signature.
Frequently asked questions
Is it safe to paste my token here?
The token is decoded in your browser and is never sent to a server. Even so, treat live tokens like passwords and prefer expired or test tokens when you can.
Does decoding verify the token?
No. Anyone can read a JWT, because the header and payload are only Base64URL encoded. Only a signature check with the right key proves it is genuine, and your server should always do that.
Which signatures can it check?
HS256, HS384 and HS512, which use a shared secret. Tokens signed with a private key (RS256, ES256 and similar) can be decoded, but not verified here.
What do iat, exp and nbf mean?
iat is when the token was issued, exp is when it expires and nbf is the time before which it must not be accepted. All three are Unix times in seconds.
Read the guides
Learn how this works and how to get the most from it.
Developer
HTTP Status Codes Explained: The Ones You Actually Need
What 200, 301, 404, 500 and other HTTP status codes mean, how 401 differs from 403, and which code to return from your API.
2 min read
Developer
Base64 Explained: What It Is and When to Use It
How Base64 encoding works, why it makes data 33% larger, where it is used (data URIs, JWTs, email) and why it isn't encryption.
1 min read
Developer
Unix Timestamps Explained
What a Unix timestamp is, the difference between seconds and milliseconds, how time zones fit in, and the Year 2038 problem.
2 min read
Security
How to Decode a JWT and Read Its Claims
A JSON Web Token has three parts. Learn what each part holds, what exp and iat mean, and why decoding a token isn't the same as trusting it.
1 min read
Related tools
Base64 & URL Encoder / Decoder
Encode and decode Base64 and URL-encoded text instantly.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes and HMACs.
JSON Formatter & Validator
Prettify, minify and validate JSON, with error line numbers.
Unix Timestamp Converter
Convert Unix epoch timestamps to dates and back, in any time zone.