JWT decoder

Paste a JSON Web Token to see its header and claims, check whether it has expired and, if you know the secret key, verify its signature.

Decode token

The token is decoded in your browser and is not sent to any server.
Algorithm
Issued at (iat)
Not before (nbf)
Expires (exp)
Signature

Verify the signature (HMAC)

If the token is signed with HS256, HS384 or HS512, enter the secret key to check that the signature is correct.

What is a JWT?

A JSON Web Token (JWT, RFC 7519) is a compact format for passing signed information between two parties. It is mainly used for authentication in APIs and web apps: after logging in, the server issues a token that the client sends with every request, usually in the Authorization: Bearer header.

A JWT has three dot-separated parts: the header (algorithm and type), the payload (the data, or claims) and the signature. The first two are Base64URL-encoded JSON.

Common claims

iss (issuer), sub (subject, usually the user id), aud (audience), exp (expiration time), nbf (not before), iat (issued at) and jti (unique identifier). Dates are expressed as a Unix timestamp in seconds.

Is it safe to paste my token here?

This page decodes the token with JavaScript in your own browser: it is not sent or stored anywhere. Still, remember that a JWT payload is not encrypted, only encoded: anyone holding the token can read it, so do not put confidential information in it and treat production tokens like passwords.