Skip to content
Owais Khan Software Reviews

JWT Decoder

Decode and verify JSON Web Tokens. Your token never leaves your browser.

Decode a JWT

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzhmMmMiLCJhdWQiOiJhcGkuZXhhbXBsZS5jb20iLCJuYW1lIjoiQWRhIExvdmVsYWNlIiwiZW1haWwiOiJhZGFAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJhZG1pbiJdLCJpYXQiOjE3OTAwMDAwMDAsImV4cCI6MTkwNjAwMDAwMH0.wAHKbmDH_A1NVzmvdiHoVj80jg71cGuKbnrGDCX9gOQ

    Verify signature (HS256)

    Signature verified with HS256.

    Header

    {
  "alg": "HS256",
  "typ": "JWT"
}

    Payload

    {
  "iss": "https://auth.example.com",
  "sub": "user_8f2c",
  "aud": "api.example.com",
  "name": "Ada Lovelace",
  "email": "[email protected]",
  "roles": [
    "admin"
  ],
  "iat": 1790000000,
  "exp": 1906000000
}

    Claims

    iss https://auth.example.com Issuer — who created and signed the token
    sub user_8f2c Subject — who the token is about, usually a user ID
    aud api.example.com Audience — who the token is meant for
    name Ada Lovelace Full name
    email [email protected] Email address
    roles ["admin"] Roles or groups
    iat 2026-09-21T14:13:20Z (in 0 seconds) Issued at — when the token was created
    exp 2030-05-26T04:26:40Z (in 3 years) Expiration time — reject the token after this

    What is inside the example token

    The example is an access token signed with HS256. Its payload says who issued it (iss), who it is about (sub), which API should accept it (aud) and when it expires (exp, 2030). The demo secret is filled in below the token, so the signature verifies; change one character of the token or the secret and it fails. Paste your own token to replace it.

    JWT signature verification in the browser

    Most decoders only decode. JWT signature verification here uses your browser’s built-in Web Crypto, the same primitives servers use, for every algorithm in the JOSE standards: HMAC (HS256–HS512), RSA (RS and PS), elliptic-curve ECDSA (ES256–ES512) and Ed25519. It is tested against the example tokens in RFC 7515 and tokens signed by Node.js.

    Decode JWT tokens from OAuth and OpenID Connect

    Access tokens and ID tokens from Auth0, Okta, Microsoft Entra, Cognito, Firebase and Keycloak are JWTs. To decode JWT tokens from them, paste the token; to check the signature, paste the provider’s JWKS (from its /.well-known/jwks.json) and the key with the matching kid is picked for you.

    Frequently asked questions

    How do I decode a JWT?
    Paste the token — with or without the "Bearer " prefix — and the header and payload appear as formatted JSON, with each claim explained underneath. A JWT is three base64url-encoded parts separated by dots: the header says how it was signed, the payload holds the claims, and the signature proves they were not changed. Decoding needs no key; verifying the signature does.
    Is it safe to paste a JWT into an online decoder?
    Only if the decoder does not send it anywhere. A valid access token lets anyone who has it act as you until it expires, and many online tools post what you paste to their server. This decoder runs entirely in your browser: the token never leaves your browser, and there is no upload, no API call and no analytics — enforced by this site’s test suite, which scans the page for every browser API that can send data and fails the build if it finds one.
    How do I verify a JWT signature?
    Under "Verify signature", enter what the algorithm in the header needs. HS256, HS384 and HS512 use the shared secret the issuer signed with — as plain text or base64. RS, PS, ES and EdDSA tokens are verified with the issuer’s public key: paste a PEM public key, a JWK, or a whole JWKS from the issuer’s jwks_uri, and the key matching the token’s kid is used. The check runs with your browser’s Web Crypto.
    What do exp, iat and nbf mean?
    They are times in seconds since 1 January 1970 (Unix time). exp is when the token expires, iat when it was issued, nbf the moment before which it must not be accepted. The decoder converts each to a date and says how long ago or how far ahead it is, and marks the token expired or not yet valid.
    Can anyone read the data in a JWT?
    Yes. A signed JWT is encoded, not encrypted: anyone who has the token can decode the payload, exactly as this page does. The signature only stops people changing it. Never put passwords, secrets or personal data you would not show the user in a JWT payload; the decoder flags claims with names like password or secret. Encrypted tokens (JWE, five parts) cannot be read without the key.
    Why does the decoder warn that my HS256 secret is too short?
    RFC 7518 requires an HMAC key at least as long as the hash — 32 bytes (256 bits) for HS256, 48 for HS384, 64 for HS512. Shorter secrets, such as a word or short phrase, can be guessed offline from any one token, after which an attacker can sign their own. Use a random 32-byte or longer secret.