Paste any JWT and instantly decode the header and payload. See all claims, expiry countdown, issued-at time, and signature algorithm. No data sent to any server — runs entirely in your browser.
Free, no sign-up — one of the SaaSQuickStart Developer tools.
A JWT consists of three Base64URL-encoded segments separated by dots: header.payload.signature. This tool splits the token on the dots, applies Base64URL decoding (swapping - for + and _ for /, then padding), and parses the resulting JSON. The signature segment is displayed raw but not verified — that requires your secret key, which you should never share with a third-party tool.
For access tokens that protect real user sessions, avoid pasting them into any online tool. This tool processes everything locally in your browser with no network requests, but the safest practice is to use a test token or a token from a development environment.
Signature verification requires either the HMAC secret or the RSA/EC public key. Asking users to provide those secrets would be a serious security risk. Use your backend SDK (e.g. jwt.Verify in Go, jsonwebtoken.verify in Node) to verify signatures server-side.
The "exp" (expiration time) claim is a Unix timestamp after which the token must be rejected. Servers that accept expired JWTs are vulnerable to replay attacks using stolen tokens. Always validate exp on the server.
HS256 uses a shared HMAC secret — both the issuer and verifier need the same secret key. RS256 uses an RSA key pair: the issuer signs with a private key and verifiers use the corresponding public key. RS256 is preferred for distributed systems where you cannot safely share a secret.