JWT Decoder (Contents, Expiry & Signature)
Paste a JWT to read its header and payload and see the expiry as a date. Enter a key to check the signature too.
JWT
0 characters · 0 lines
Everything runs on this device. What you enter is never sent anywhere.
A JWT can work just like a login key. Don't paste it into other sites you don't trust.
Decoded
The result appears here
Found it useful? We'd love a share
Something not working, or an idea to make it better?
How to use
1. Paste a JWT
Tap “Paste” above the top box to put in the JWT you copied. A “Bearer” prefix or surrounding quotes are fine to leave in. To just try it out, tap “Sample”.
Click “Paste” above the left box to put in the JWT you copied. A “Bearer” prefix or surrounding quotes are fine to leave in. To just try it out, click “Try a sample”.
2. See what's inside
A badge such as “Valid” or “Expired” appears in “Decoded” below. Under it, the expiry and issue times are listed in this device's time, along with “in 2 years” or “3 hours ago”. The header and payload JSON come next. Tap “Copy payload” to copy the formatted JSON.
A badge such as “Valid” or “Expired” appears above the right box. Below it, the expiry and issue times are listed in this device's time, along with “in 2 years” or “3 hours ago”. The header and payload JSON come next. Click “Copy payload” to copy the formatted JSON.
3. Check the signature
In “Check the signature” at the very bottom, enter the secret key for HS256 and similar, or the public key for RS256, ES256 and similar. “The signature is valid” or “The signature doesn't match” appears right away. The sample token's key is papatto-sample-secret.
In “Check the signature” at the bottom left, enter the secret key for HS256 and similar, or the public key for RS256, ES256 and similar. “The signature is valid” or “The signature doesn't match” appears right away. The sample token's key is papatto-sample-secret.
Great for
Finding out why a login suddenly ends
Paste a token to see its expiry (exp) and issue time (iat) in this device's time, along with “5 minutes ago” and the like. The badge tells you at a glance if it's expired, making clock drift or too-short lifetimes easy to spot.
Web developers and support staff
Checking what's in a token
Read the subject (sub), issuer (iss), audience (aud) and custom claims such as roles as formatted JSON. Text copied from your browser's developer tools with “Bearer” in front can be pasted as is.
Anyone building or testing APIs
Checking that the signing key matches
Enter an HS256 secret or an RS256 or ES256 public key (PEM or JWK) to see right away whether the signature was made with that key. Handy for tracking down failed authentication caused by a misconfigured key.
Developers working on authentication
Keeping real tokens to yourself
Decoding and checking both happen entirely in this device's browser. Tokens and keys are never sent to a server, so you don't hand your credentials to someone else's server.
Anyone who cares about security
Good to know
- A JWT's contents aren't encrypted. Anyone can read them, so don't put passwords or anything else you'd want to keep hidden in one.
- The contents of an encrypted JWT (JWE) can't be read. Only the header can.
- Public keys aren't fetched automatically (from a JWKS URL). Paste the key yourself, because this page never connects to anything outside.
About JWT
A JWT (JSON Web Token) is a string that carries information about a logged-in user and their permissions in 3 parts: “header.payload.signature”. The header and payload are just JSON in the URL-safe form of {tool:base64}, so anyone can turn them back and read them. What prevents tampering is the signature at the end.
This tool shows the payload's exp (expires), nbf (not before) and iat (issued at) as dates in this device's time zone, along with phrases like “in 3 hours”, and a badge tells you if it has expired. You can also convert plain-number timestamps with {tool:unix-time}. Enter a key and it checks whether HS256, RS256, PS256, ES256, EdDSA and other signatures are valid, right in your browser.
FAQ
Answers to common questions before you start.
Is the JWT I paste sent anywhere?
No. Decoding and signature checks happen only in your device's browser, and neither the JWT nor the key is sent to a server. A JWT can work just like a login key, so avoid pasting it into other sites when you don't know what they do with it.
How do I read the expiry (exp)?
The badge above “Decoded” shows “Valid”, “Expired”, “Not yet valid” or “No expiry”. The list below shows the expiry date in this device's time zone, with the time from now, like “in 3 hours” or “2 days ago”.
Can it check the signature?
Yes. Enter the secret key (as text or Base64) for HS256, HS384 or HS512, or the public key for RS256, PS256, ES256, EdDSA and others, and “The signature is valid” or “The signature doesn't match” appears right away.
What public key formats can I use?
It reads PEM starting with “-----BEGIN PUBLIC KEY-----”, “-----BEGIN RSA PUBLIC KEY-----”, certificates (-----BEGIN CERTIFICATE-----), JWK and JWK Set ({"keys": […]}). With a JWK Set, it picks the key with the same kid as the header.
Can I paste it with “Bearer” still in front?
Yes. An “Authorization: Bearer” line, and spaces, line breaks or quotes around the token, are removed automatically before it's read.
It says “Unsigned JWT (alg: none)”
This token has no signature, so anyone can change what's inside. Unless it's for testing, review your server settings. Servers that use JWTs for login must never accept one with alg set to none.
It says “Encrypted JWT (JWE)”
A JWT split into 5 parts by “.” is a JWE, whose contents are encrypted. It can only be read with the recipient's private key, so this tool shows just the header (the encryption method and so on).
It says “This can't be read as a JWT”
Either part of it was cut off when you copied it, or it contains characters a JWT can't use. The tool says which part can't be read and marks the spot in orange in the input box, so check there.
Is a JWT encrypted?
No. The header and payload are just swapped for characters using a fixed table (base64url), so anyone can read them. Don't put passwords or personal information in one.
Is it free?
Yes, it's free. No sign-up and no ads.
More tools
- Convert full-width and half-width
Convert letters, numbers and katakana between full-width and half-width in one go.
- Hiragana ⇔ katakana converter
Convert between hiragana, katakana and half-width katakana in one go. Kanji, letters and numbers are left as they are.
- Character Counter for X, Instagram & YouTube
See how many characters you have left before the limit on X, Instagram, YouTube and more, counted the way each platform does. Also shows characters, lines, words and bytes.
- JSON formatter
Pretty-print JSON or minify it to one line. If there's a mistake, it shows you where.
- URL Encode / Decode
Encode text and symbols into a URL-safe form (like %C3%A9) or decode it back to the original text.
- Password generator
Choose the length and characters to make hard-to-guess passwords on the spot.