JWT decoder online

Paste a JSON Web Token to read its header and payload and see the issue and expiry dates in your time zone. With the secret key you can also verify an HS256, HS384 or HS512 signature. Everything runs in your browser, so the token and the key are never sent anywhere.

Build it in the builder

Loading the tool...

How to set it up

  1. 1

    Paste the token

    Copy the JWT from an Authorization header, a cookie or an API response and paste it into the field. No need to remove the Bearer prefix or line breaks, the decoder does that for you.

  2. 2

    Read the header and payload

    The header shows the signing algorithm (alg) and the token type. The payload holds the user id, the role and any other fields the server put there. Non-Latin text is shown as is.

  3. 3

    Check the expiry

    The iat, nbf and exp claims store time in seconds since 1970. The decoder turns them into regular dates in your time zone and tells you whether the token is still valid or has expired.

  4. 4

    Verify the signature

    For HS256, HS384 and HS512 tokens, enter the secret key: the decoder recomputes the signature and tells you whether it matches. RS256 and ES256 need a public key and are not verified here.

Frequently asked questions

The token and the key are processed only in your browser, the page sends nothing to a server. Keep in mind that anyone holding a JWT can read its payload. The signature protects against forgery, not against reading, so never put passwords in a token.

The payload of a JWT is not encrypted, only base64url encoded, so anyone can read it without a key. Verifying the signature answers a different question: was the token issued by someone who has the secret, and has it been changed since.

The exp claim holds the moment the token stops working. Once that time has passed, the server will reject the token. Get a new one by signing in again, or refresh it with a refresh token if the service supports that.

HS256, HS384 and HS512, which sign the token with a shared secret key. For RS256, ES256 and other public key algorithms the decoder still shows what is inside the token but does not offer a signature check.

The nana800 builder has a SIGN JWT block that issues a token with sub, iss, aud, a lifetime and your own data. The VALIDATE JWT block checks the signature and expiry of an incoming token. Both use HS512, so you can decode and verify those tokens on this page. A ready template issues a token on a webhook request in one chain and checks it in another.

Build your first scheme for free

Sign-up is free and needs no card. Every month the balance is topped up to $3.50 for free, enough for about 3,500 runs of basic blocks.

Build it in the builder