JWT Decoder

Inspect the header, payload and claims of a JSON Web Token, and check an HMAC signature against your secret.

Your token never leaves this page. Decoding and signature checking both run in your browser — there is no server to send it to. Still, treat any token you paste anywhere as one you should rotate.

Encoded token

What is inside a JWT

A JSON Web Token is three base64url-encoded strings joined by dots. The first two are encoded, not encrypted — anyone holding the token can read them, which is why a JWT should never carry anything secret.

Header: Which algorithm signed the token (alg) and often which key (kid). An alg of none means the token is unsigned — anyone can write one.
Payload: The claims. exp, nbf and iat are Unix seconds, which this page reads out as dates so you can see at a glance whether the token is still inside its window.
Signature: Proof that the first two segments were not altered after signing. Checking it needs the shared secret (HS256/384/512) or the public key (RS, ES). Decoding never needs either.

A valid signature is not authorisation

It proves the token is intact and was signed by whoever holds the key. It does not prove the token is still current, that it was issued for your service (check aud), or that the account behind sub still holds the roles written into it. Those are checks your application makes on every request — a decoder cannot make them for you.