JWT Decoder & Verifier

Paste a JSON Web Token to see its header and payload decoded, with the timestamp claims rendered as readable dates and expiry checked against the current time.

Add the signing secret or public key to verify the signature as well. Leave it blank and the token is only decoded — which is all you need to read a token, and is not enough to trust one.

How it works

A JWT is three base64url segments joined by dots: header, payload and signature. The first two are plain JSON. They are encoded, not encrypted, so anyone holding the token can read every claim inside it without a key of any kind. This is the single most misunderstood thing about JWTs — never put anything in a payload that the bearer should not see.

The signature is what makes a token trustworthy. It covers the header and payload together, so changing a single character of either invalidates it. With HS256 the signature is an HMAC and the same shared secret both signs and verifies, meaning every service that can check a token can also mint one. With RS256 and ES256 the private key signs and the public key verifies, so verifiers cannot forge — which is why asymmetric algorithms are the right choice the moment more than one service is involved.

Two claims control validity in time. exp is the expiry and nbf the "not before"; both are Unix timestamps in seconds, and both are checked below against the current time. Because a JWT is self-contained, there is no way to revoke one before it expires without keeping server-side state — which is why sensible access tokens are short-lived and paired with a refresh token.

This tool never takes the algorithm from the token's own header. That habit is the root of the classic JWT attacks: alg: none, where a library accepts an unsigned token as valid, and algorithm confusion, where an attacker takes an RS256 public key, re-signs the token as HS256 using that public key as the HMAC secret, and a naive verifier accepts it. You choose the algorithm here; if the header disagrees, that is reported as a finding rather than obeyed.

Frequently asked questions