Tools / JWT decoder

JWT decoder

Paste a JSON Web Token to read its header and claims and check whether it's expired. Everything runs in your browser — the token and any secret you enter are never transmitted.

Token

HS256 secret (optional — to verify the signature)

Header

—

Payload

—

Checks

—

What it does

Base64url-decodes the header and payload and pretty-prints them.
Resolves exp, nbf, iat to readable UTC times and tells you if the token is expired or not yet valid.
With a secret, verifies an HS256 signature using the Web Crypto API (SubtleCrypto).

RS256 / ES256 verification needs the issuer's public key and is not done here. Never paste production signing secrets into any web tool you don't control — this one keeps them local, but that is a habit worth having.