All tools / Security & identifiers
JWT decoder
Paste a JSON Web Token to read its claims and check when it expires. Your token never leaves this page.
Common questions
Is it safe to paste a production token here?
The token is decoded in your browser and never sent anywhere. Still, treat a valid token like a password: anyone who has it can use it until it expires.
Can anyone read a JWT?
Yes. The header and payload are only Base64URL-encoded, not encrypted. Never put passwords or secrets in JWT claims. The signature only proves the token was not changed.
Why can't I verify RS256 or ES256 tokens?
Those use a public/private key pair. Verify them in your backend against the issuer's JWKS endpoint (usually /.well-known/jwks.json). This tool verifies HMAC (HS*) tokens with a shared secret.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued and nbf is when it starts being valid. All three are Unix timestamps in seconds.