JWT decoder and verifier
Pin to your toolsDecode a JSON Web Token, check its expiry and claims, and verify its signature with a secret or public key.
Runs entirely in your browser. What you type is never sent to our servers.
Payload
A secret for HS256/384/512, a public key as PEM (SPKI or certificate) for the others, or a JWK or JWKS (the key is picked by the token’s kid). The key is never shared or saved.
history · 0
Processed input shows up here while this page is open. Reloading the page clears it.
Code examples
Copy and paste these into your own project. Each one uses only the language's standard library, so there is nothing to install.
const token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'
const payload = token.split('.')[1]
const json = Buffer.from(payload, 'base64url').toString('utf8')
console.log(JSON.stringify(JSON.parse(json), null, 2))What it does
Decode a JSON Web Token to read its header and payload, see whether it has expired, and verify its signature with a secret or a public key. The token is decoded in your browser, this page shows no ads, and the token and key are never shared or saved.
How to use it
- Paste the token. A
Bearerprefix and line breaks are ignored. - Read the payload as formatted or compact JSON. Below it you see the algorithm, the status, and the
exp,nbfandiattimes next to how far they are from now. - To verify the signature, enter the key: a secret for HS256, HS384 and HS512, or a public key (PEM or JWK) for RS, PS, ES and EdDSA.
- Switch the header and the payload between JSON and Claims: Claims lists each claim with what it means and shows time claims as dates.
- Open the Encode tab to write a header and a payload and sign them with a secret or a private key (PKCS#8 PEM or JWK). Nothing on that tab is saved, shared or added to the history.
Examples
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
The payload of that token:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
Its signature verifies with the secret your-256-bit-secret.
Good to know
- Decoding is not verifying: the payload is only encoded, not encrypted, and anyone can read it.
- Your server must verify the signature before trusting any claim.
- A token with the algorithm
noneis unsigned, so anyone could have made it. - Treat live tokens like passwords. Prefer expired or test tokens when you paste one here.
- A pasted JWKS is searched for the token’s
kid, and a single JWK is used as it is. The page never fetches a key set from the token’s issuer. - An HMAC secret shorter than its hash (32, 48 or 64 bytes) can be guessed, so the page warns you. A secret can be read as UTF-8 text or as Base64URL.
What is a JWT?
A JSON Web Token is three Base64URL parts joined by dots: a header naming the signing algorithm, a payload with claims such as who the token is for and when it expires, and a signature. Anyone can read the first two parts; only the signature proves the token came from someone holding the key.
Frequently asked questions
Is decoding a token the same as verifying it?
No. Decoding only reads the contents, which are not encrypted. Verifying checks the signature with the key, and your server must do that before it trusts any claim.
What do exp, nbf and iat mean?
exp is when the token expires, nbf is the time before which it is not valid and iat is when it was issued, all in seconds since 1970. This tool compares them with your device's clock.
Is it safe to paste a real token here?
The token is decoded in your browser and never sent to our servers, and this page shows no ads. Still, treat live tokens like passwords: prefer expired or test tokens.