Scrawlspace › Developer Utilities

JWT Decoder

Paste a JSON Web Token to decode its header and payload, see when it expires, and verify its signature with a secret or public key.

How to use JWT Decoder

1. Paste a JWT into Encoded token. A leading Bearer is ignored.
2. Read the decoded Header, Payload and Claims, including expiry.
3. To verify, enter the secret for HS tokens or a public key (PEM, JWK or JWKS) for others.
4. Use Copy JSON to copy the decoded parts.

Frequently asked questions

What is a JWT?

A JSON Web Token is a compact, signed token made of three Base64URL parts: a header, a payload of claims, and a signature. It's commonly used for login sessions and API access.

Is it safe to paste a JWT into a website?

Here it is decoded and verified in your browser with the Web Crypto API, and the token is never sent to a server. Still, treat live production tokens with care.

How do I check if a JWT has expired?

Paste it in and look at Expires. The exp claim is shown as a date with how long ago or from now it is.

Which signature algorithms can it verify?

HS256/384/512 with a secret, and RS, PS, ES (P-256, P-384, P-521) and EdDSA (Ed25519) with a public key.

Can anyone read the data in a JWT?

Yes. The payload is only encoded, not encrypted, so never put secrets in it. The signature only proves it hasn't been changed.