DigiTools

Nothing uploaded

JWT decoder

Paste a JSON Web Token to see its header and payload, with exp, iat and nbf as dates and a clear expired or valid status. Your token never leaves your browser.

Decoding shows what’s inside a token, but doesn’t prove it’s genuine: check the signature for that.

Paste a token to decode it.

Claims explained

Paste a token to see its claims.

Check the signature

For tokens signed with HS256, HS384 or HS512. The secret stays on this device. The example token’s secret is your-256-bit-secret.

What you type stays on this device. Nothing is uploaded.

How to decode a JWT

  1. Paste your token. It usually starts with eyJ.
  2. Read the header and payload, and the claims explained with their dates and whether the token has expired.
  3. To check an HS256, HS384 or HS512 signature, enter the secret and press Check signature.

Questions

Is it safe to paste a real token?

Here, yes: the token is decoded in your browser on this device and never sent anywhere, not even to us. Many online decoders send tokens to a server, where a live one could be used to sign in as you. Still, treat tokens like passwords.

Does this check that the token is genuine?

Decoding only reads the token, and anyone can make a token that says anything. It’s genuine only if its signature checks out with the right key. This tool checks HS256, HS384 and HS512 signatures with a shared secret; RS256, ES256 and other public-key signatures need your server or library.

What do exp, iat and nbf mean?

They’re times, in seconds since 1 January 1970 (UTC): exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. They’re shown as dates in your time zone.

Why does it say the token is encrypted?

A token with five parts is a JWE: its contents are encrypted and can only be read with the key. A signed token (JWS), the usual kind, has three parts.