JWT Decoder
Decode a JSON Web Token to read its header and payload, check expiry, and optionally verify an HS256 signature — all in your browser.
This JWT decoder reads the header and payload of a JSON Web Token so you can inspect its claims. Paste a token to decode a JWT, check the expiry, or debug an auth issue by reading iss, sub and exp. For HS256 tokens you can paste the secret to verify the signature. Your token and secret never leave your browser, which matters because a token is a credential.
Read the guide: How to Decode and Verify a JWT- iat
- Thu, 18 Jan 2018 01:30:22 GMT
How it works
- 1
Paste a JWT
Drop the token in. The header and payload are decoded immediately.
- 2
Read the claims
Inspect standard claims like iss, sub, exp and iat, with expiry highlighted.
- 3
Verify (optional)
For HS256 tokens, paste the secret to confirm the signature is valid.
Instant & 100% private — nothing is uploaded
Everything runs locally in your browser. Your code, text and files are processed on your own device and are never sent to a server — so there are no upload waits, no size limits from us, and nothing is ever stored or logged.
Frequently asked questions
- Is my token sent anywhere?
- No. Decoding and verification happen entirely in your browser. Your token and secret never leave your device — important, since tokens are credentials.
- Can it verify the signature?
- Yes, for HMAC (HS256/384/512) tokens when you supply the secret. RS/ES signatures are decoded and displayed but verification requires the public key.
- Why does it say my token is expired?
- The exp claim is a Unix timestamp. The decoder compares it to the current time and flags tokens whose exp is in the past or whose nbf is in the future.
More tools
More from the Hivly network
Free sister tools on our other sites.