DevStack
Back

Development

JWT Decoder

Paste a JWT to read the header and payload, including issuer, subject, audience, and expiry. The signature stays unchecked until you paste the HMAC secret or PEM public key that belongs to that token. Encrypted tokens show the header only. Nothing is stored.

JWT

Header and payload

Decode the base64url parts into JSON and list the standard time claims.

Optional signature check

HS256, HS384, and HS512 use the shared secret you paste. RSA and ECDSA use a PEM public key.

Expiry

See whether exp or nbf says the token is current, expired, or not yet valid.

Input

Paste a token to read the header and payload. Add a key only if you want the signature checked.

Paste a JSON Web Token. The header and payload are decoded without a key. Add your HMAC secret or PEM public key only when you want the signature checked. The token is not stored.