Tools / JWT decoder
JWT decoder and HMAC signature check
Paste a token to see its header and payload. Decoding needs no key; checking the signature of an HMAC token needs the shared secret, which stays on this page.
Header
Payload
Registered claims
Check the signature
Examples:
What decoding does and does not tell you
A JWT (RFC 7519) is three Base64url parts joined by dots: a JSON header, a JSON payload and a signature. The first two are only encoded, not encrypted, so anyone holding the token can read them. Do not put anything in a payload that the holder should not see.
Decoding proves nothing about authenticity. A token is only trustworthy after its signature has been verified with the right key, and after the receiver has checked exp, nbf, iss and aud against its own expectations. This page verifies HMAC signatures (HS256, HS384, HS512). RSA and ECDSA tokens (RS256, ES256 and others) need the issuer's public key and are only decoded.
Pitfalls
alg: "none" marks an unsigned token. Libraries that accepted it, or that let the token's own header pick the algorithm, have had serious vulnerabilities. A verifier should accept only the algorithm it expects.
exp, nbf and iat are NumericDate values: seconds since the epoch, not milliseconds. A value with thirteen digits is a bug in the issuer. Small clock differences between machines are common, so verifiers usually allow a minute or two of leeway.
A token with five parts is a JWE, an encrypted token. Its payload cannot be read without the decryption key.
Avoid pasting production tokens into tools you do not control. This page sends nothing anywhere (its Content Security Policy forbids it), but a valid token is a credential until it expires.