Development
JWT Decoder
Paste a JWT to read the header and payload, including issuer, subject, audience, and expiry. The signature stays unchecked until you paste the HMAC secret or PEM public key that belongs to that token. Encrypted tokens show the header only. Nothing is stored.
Quick start
- 1
Paste the token
Use a token you are allowed to inspect. It needs a header, payload, and signature.
- 2
Decode
The header and payload are shown as JSON, with issuer, subject, audience, and time claims.
- 3
Check the signature
Leave the key empty to skip the check. Paste the HMAC secret for HS256, HS384, or HS512, or a PEM public key for RSA and ECDSA.
- 4
Read the status
The page says whether the signature matches and whether the token is expired. Copy or download JSON if you need a record.
Features
Header and payload
Decode the base64url parts into JSON and list the standard time claims.
Optional signature check
HS256, HS384, and HS512 use the shared secret you paste. RSA and ECDSA use a PEM public key.
Expiry
See whether exp or nbf says the token is current, expired, or not yet valid.
Specifications
- Algorithms
- HS, RS, PS, and ES signatures
- Encrypted tokens
- Header only
- Key
- Optional, not stored
- Privacy
- Not stored
Use cases
- Inspect a token from an API response.
- Confirm an expiry time before debugging a 401.
- Check a signature with a key you already hold.
Frequently asked questions
Does decoding prove the token is genuine?
No. The payload is readable without a key. The signature is checked only when you supply the matching secret or public key.
Can this recover a signing secret?
No. It does not guess or search for a secret. An encrypted token is not decrypted.