Is it safe to paste a real token here?

Here, yes - it is decoded in the page and never sent anywhere, and you can confirm that in your browser's Network tab. It is not safe as a general habit: a JWT is a working credential, and most online decoders post it to a server.

Does decoding a token prove it is valid?

No. The header and payload are just base64url - anyone can read them, and anyone can write them. Only checking the signature tells you the token is genuine, which is what Verify does.

Which signature algorithms can it verify?

HS256, HS384 and HS512, the shared-secret algorithms, when you supply the secret. Tokens signed with RS256 and the other public-key algorithms decode fine but are not verified here.

What does the expiry actually mean?

The exp claim is the moment the token stops being accepted, shown here as a readable date. A token can be perfectly well-formed and correctly signed and still be refused because that time has passed.

Can I edit a token and re-sign it?

No. This reads tokens, it does not mint them.

Stays on your computer How this works

Free JWT decoder

Read a token's contents without sending it anywhere

Decoding and verifying use no libraries and make no network requests. Decoding is base64url and JSON; verification uses the browser's own crypto. Your token stays in this tab — which is not true of every site that offers this.

Token

HS256Not expired

Subject1234567890

Issued at9/1/2025, 12:00:00 AM411 days ago

Expires1/1/2030, 12:00:00 AMin 1172 days

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "admin": true,
  "iat": 1756684800,
  "exp": 1893456000
}

Signature

OCLumBv-TYViklVPjVkq20q5m4-OMDXfozUoz9Vhgd4

Check the signature

Secret is base64

About this JWT decoder

Decodes a JSON Web Token and shows its header, payload and expiry in readable form, and can verify an HS256, HS384 or HS512 signature if you supply the secret.

Tokens routinely carry user identifiers, email addresses and session details, so pasting one into a random website is a real disclosure. This one decodes it in the page and sends nothing anywhere. It is free to use, with no account and no upload limit, and it runs entirely in your browser: nothing is uploaded, and while the page stays open, a feature you have already used keeps working offline.

What you can do

Decode a JWT’s header and payload into readable JSON
Check whether a JWT has expired, and how long ago or how long it has left
Issued at, expiry and not before shown as readable dates, with issuer, subject, audience and JWT ID
Verify HS256, HS384 and HS512 signatures with the shared secret
Shows the signing algorithm, and warns when a token is unsigned (alg none)
Paste the token with its Bearer prefix still attached
Copy the decoded payload
Loads no third-party scripts and makes no network requests while decoding

How to decode a JWT

Paste the token in. There is a Sample if you want to see the shape first.
The header, the payload and the expiry are decoded as you go. A token with no exp claim is marked No expiry set.
To check the signature, paste the shared secret and press Verify. The secret is used as plain text; if yours was given to you base64-encoded, tick "Secret is base64".
Copy the payload if you need it elsewhere.

Questions

Is it safe to paste a real token here?: Here, yes - it is decoded in the page and never sent anywhere, and you can confirm that in your browser's Network tab. It is not safe as a general habit: a JWT is a working credential, and most online decoders post it to a server.
Does decoding a token prove it is valid?: No. The header and payload are just base64url - anyone can read them, and anyone can write them. Only checking the signature tells you the token is genuine, which is what Verify does.
Which signature algorithms can it verify?: HS256, HS384 and HS512, the shared-secret algorithms, when you supply the secret. Tokens signed with RS256 and the other public-key algorithms decode fine but are not verified here.
What does the expiry actually mean?: The exp claim is the moment the token stops being accepted, shown here as a readable date. A token can be perfectly well-formed and correctly signed and still be refused because that time has passed.
Can I edit a token and re-sign it?: No. This reads tokens, it does not mint them.