← All tools
🔒 Decoded locally — never sent anywhere

JWT Decoder & Validator

Paste a JSON Web Token to see its header, payload, and expiry status. Optionally verify an HS256/HS384/HS512 signature with your secret.

💡 For when you've copied a token from a login response or API call and want to see what's actually inside it.

How it works

A JWT has three base64url-encoded parts separated by dots: a header, a payload, and a signature. This tool splits the token, base64url-decodes the header and payload as JSON, and — if you provide a secret — recomputes an HMAC-SHA signature using your browser's built-in Web Crypto API to check it matches. None of this requires a network request, so it works even if you're offline and it's safe to paste tokens containing real user data (though we'd still recommend using redacted or test tokens where possible).

Common claims

  • exp — expiration time (Unix timestamp); the token is invalid after this.
  • iat — issued-at time.
  • nbf — not-before time; the token isn't valid before this.
  • sub — subject, usually the user or entity the token represents.
  • iss / aud — issuer and intended audience.