Skip to content
parsing.tools

JWT Decoder

Paste a login token (JWT) to read what is inside it and when it expires.

  • Free, no account
  • Nothing uploaded
  • 13 tools

This decodes a token. It does not prove the token is genuine. The signature is checked only if you enter an HMAC secret below. A token that has not expired is a credential: debug with expired or test tokens.

Check an HMAC signature (optional)

Decoded
  • Signature: not checked (HS256)
  • Expiry: 2026-01-01T01:00:00.000Z

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "iss": "https://auth.example.com",
  "sub": "user_1042",
  "name": "Sample User",
  "role": "editor",
  "iat": 1767225600,
  "exp": 1767229200
}
Claims
isshttps://auth.example.comIssuer: who created the token
subuser_1042Subject: who the token is about
nameSample User
roleeditor
iat2026-01-01T00:00:00.000ZIssued at
exp2026-01-01T01:00:00.000ZExpiration time (seconds since 1970-01-01 UTC)
Decoded here, no request made. Token and secret are held in memory only.

Nothing you paste is uploaded. The server sends connect-src 'self', so your browser blocks this page from contacting any other host. Check it yourself

Decode the header and payload of a JSON Web Token, read exp, iat and nbf as dates, and check an HS256/384/512 signature with your secret. The token is not stored.

Anatomy of a JWT

A JWT is three Base64URL parts separated by dots: header, payload and signature.headerpayloadsignaturealgorithm, typeclaims: sub, exp, iat…proves the first tworeadable by anyonereadable by anyoneneeds a key to check

The header and the payload are JSON, Base64URL-encoded. They are not encrypted: anyone holding the token can read them, which is all a decoder does. The signature is computed over header.payload with a key, and it is the only part that says the token was issued by who it claims.

Decoded is not verified

A server must verify the signature with the expected algorithm and key, and then check exp, nbf, aud and iss. Reading the claims from an unverified token and trusting them is the classic JWT vulnerability. This page checks HMAC signatures (HS256, HS384, HS512) when you enter the secret. For RS256, ES256, PS256 or EdDSA it says the signature was not checked, and never reports such a token as valid.

Handling tokens

A token that has not expired is a credential. The token and the secret you type here stay in memory: they are not written to storage, and "Copy link" is not offered on this page. Prefer expired or test tokens when debugging, and see Verify privacy for how to confirm what this page does with them.

Questions

Short answers to what people ask most.

Does decoding a JWT prove it is authentic?

No. The header and payload are only Base64URL-encoded JSON, which anyone can read or forge. Authenticity comes from verifying the signature with the right key, and from checking exp, aud and iss. This page decodes; it verifies HMAC signatures only when you enter the secret.

Which signatures can be checked here?

HS256, HS384 and HS512, using the Web Crypto API. RS256, ES256, PS256 and EdDSA need the issuer's public key and are reported as "not checked", never as valid.

Is it safe to paste a production token?

A live token is a credential: whoever holds it can act as the user until it expires. This page does not send or store it, and you can confirm that in DevTools, but the careful habit is to inspect expired or test tokens and to revoke any real token that has been pasted into a tool you have not verified.

What do exp, iat and nbf mean?

They are NumericDate values: seconds since 1970-01-01 UTC. exp is when the token stops being valid, nbf is when it starts, and iat is when it was issued. The decoder shows each as an ISO date and compares exp with the clock of your computer.