JWT Decoder and Verifier
Decode a JSON Web Token, read its claims and expiry, and verify its signature, all in your browser.
Runs entirely in your browser. Nothing you paste is sent to our server, stored or logged.
What it says
Header
Payload
Claims in plain words
Verify the signature
The example token is signed with the secret toolquilt-example-secret.
Paste a JSON Web Token to see what is inside: the header, the claims in the payload, and when it was issued and expires, in your own time zone. Add the secret or the public key and the signature is checked too. A JWT is often a live credential, so it is decoded and verified on your computer and never sent anywhere.
What a JWT is
A JSON Web Token is three pieces of Base64URL joined by dots: a header that names the signing algorithm, a payload of claims such as who the token is for and when it expires, and a signature. The header and payload are encoded, not encrypted, so anyone holding the token can read them. Never put a secret in a payload.
Decoding is not verifying
Reading a token tells you what it claims; only the signature tells you whether to believe it. A server must check the signature with the right key, the expiry in exp and usually the issuer and audience, and must reject alg: none. Paste the key here to check a signature the same way.
Secrets, public keys and algorithms
HS256, HS384 and HS512 are signed and checked with one shared secret. RS, PS, ES and EdDSA tokens are signed with a private key and checked with the matching public key, which is safe to share; paste it as PEM or as a JWK. Verifying never needs the private key, and this page refuses one if you paste it.
How to use the jwt decoder
- Paste a tokenPaste a JWT, with or without the Bearer prefix, or load the example.
- Read the claimsSee the header, the payload and every date in plain words, with whether the token has expired.
- Verify the signatureAdd the secret or public key, and the signature is checked as you type.
Common questions
Is it safe to paste a real token here?
The token is decoded and verified in your browser and is never sent to our server or anyone else, and there is no share link. Even so, treat a live token like a password: prefer a test token, and revoke a real one if it has been pasted somewhere you do not control.
Can anyone read a JWT?
Yes. The header and payload are only Base64URL encoded, so anyone with the token can read them. The signature stops them being changed, not being read. For privacy, use an encrypted token (JWE) or keep sensitive data out of the payload.
Why does my token say it has expired?
The exp claim is a Unix time in seconds, and it is in the past. Tokens are kept short lived on purpose; the client should use a refresh token to get a new one. If it expired early, check that the server's clock is right.
What does invalid signature mean?
The token was not signed with the key you entered, or something in it was changed after signing. Check that you have the right secret or the public key that matches the token's kid, and that the token was copied whole.
What is alg none?
A token with alg set to none has no signature at all. Some old libraries accepted it as valid, which let anyone forge a token. A server should always reject it.
What is the difference between HS256 and RS256?
HS256 uses one shared secret to both sign and check, so every service that checks tokens could also create them. RS256 signs with a private key and checks with a public key, so services can verify tokens without being able to forge them.
More developer tools
Like this one, every developer tool here runs in your browser and never sends what you paste to a server.
JSON Formatter and Validator
Pretty print, minify and validate JSON, with the exact line of any error and how to fix it.
Base64 Encoder and Decoder
Encode text or files to Base64 and decode Base64 back to text, an image or a file.
URL Encoder and Decoder
Percent encode text for URLs and decode encoded URLs and query strings back to readable text.
UUID Generator
Generate random version 4 or time ordered version 7 UUIDs, one or a thousand at a time.
Hash Generator
Get the SHA-256, SHA-512, SHA-1 and MD5 hash of any text or file, and check a download's checksum.
Cron Expression Generator
Write a cron schedule, read it in plain English and see when it runs next.
Unix Timestamp Converter
Turn Unix timestamps into readable dates and back, in seconds or milliseconds.
Chmod Calculator
Convert Linux file permissions between numbers and letters, and see who can do what.