About JWT Decoder

JWT Decoder shows the header and payload of a JSON Web Token as formatted JSON, lists the time claims (exp, iat, nbf) as ISO dates, and flags whether the token is valid, expired, or not yet valid.

If the token uses HS256, HS384, or HS512, you can paste the shared secret and the signature is recomputed and checked in your browser. The token and secret are never uploaded.

How to use it

  1. Paste a token, or load the example.
  2. Read the header, payload, and the claim table.
  3. For an HMAC token, paste the secret and press Verify.

Common questions

Is the token sent anywhere?

No. Decoding and verification run in the page.

Can it verify RS256 or ES256 tokens?

It can decode them but not verify them; that needs the public key and extra handling. Only HS256/384/512 can be verified here.

Does decoding a token mean it is trustworthy?

No. Anyone can read a JWT. Only a verified signature tells you it is authentic and unmodified.

What do the time claims show?

exp, iat, nbf, and auth_time are converted from Unix seconds to ISO dates, and the badge compares exp and nbf to now.