Free tool · works offline · your token stays in your browser
JWT decoder.
See what is inside a JWT and whether it has expired, without pasting a live token into someone else's server. The header and payload are decoded right here in your browser (open the Network tab and watch: no request carries your token), every timestamp is shown as a real date with the time left, and you can verify the signature with your secret or public key, also locally.
- Decodes offline, nothing sent
- Expiry check with time left
- Signature verify: HS, RS, PS, ES
- Warns on alg none + no exp
Your token
Paste a JWT (with or without "Bearer "). Decoding happens on this page only.
Header
Payload
Verify the signature (optional)
HS256/384/512: paste the secret. RS, PS or ES: paste the PEM public key. Checked with your browser's Web Crypto, locally.
How it works
- A JWT is three base64url parts joined by dots: header, payload, signature (RFC 7519). The header and payload are only encoded, not encrypted, so anyone holding the token can read them. This page decodes them with your browser's own base64 and JSON functions.
- Expiry:
exp,iatandnbfare NumericDate values, seconds since 1970 in UTC (RFC 7519, section 2 and 4.1). We show each as a date in your time zone and how long ago or how far ahead it is. - Signature check: decoding does not prove a token is genuine. Paste the secret (HMAC) or public key (RSA, RSA-PSS, ECDSA) and the page verifies the signature with the Web Crypto API, which is built into your browser. The key never leaves the page either.
- Five parts? That is an encrypted JWE token. Only its header is readable without the decryption key.
Standards: RFC 7519 (JWT), RFC 7515 (JWS), RFC 7518 (algorithms), checked Oct 23, 2026.
FAQ
Is it safe to paste a JWT into an online decoder?
Only if it decodes locally. A token is a bearer credential: whoever holds it can use it until it expires. This decoder runs entirely in your browser and makes no request with your token, but the safest habit is to paste expired or test tokens, and to treat a live production token like a password.
Is a JWT encrypted?
No. A normal JWT (a JWS, three parts) is signed, not encrypted: the header and payload are base64url-encoded JSON that anyone can read. Never put secrets in the payload. Encrypted tokens (JWE) have five parts.
How do I check if a JWT is expired?
Read the exp claim: it is a unix timestamp in seconds. If it is in the past, the token is expired. Paste the token above and the status shows expired or valid, with the exact time left.
Can I decode a JWT without the secret?
Yes. Decoding the header and payload needs no key. The secret or public key is only needed to verify that the signature is genuine, which you can also do above.
Is a JWT a bearer token?
Usually, yes. Most APIs send it as Authorization: Bearer <token>, which means anyone who has it can use it. That is why short expiry times and HTTPS matter.
How do you pronounce JWT?
RFC 7519 says the suggested pronunciation is the same as the English word "jot".
Launch knowing nobody can read your users' data or steal your keys
Leaked tokens and keys are how most small apps get broken into. The Launch Check is a plain-English report on the holes in your Lovable, Bolt or Supabase app (exposed keys, open database rules, auth gaps), in 48 hours, $49. Guaranteed: if a problem we should have caught turns up later, we review it and write the fix free.
Get the $49 Launch Check →