How to decode a JWT
- Paste the token. A leading "Bearer " is removed automatically.
- Read the header and payload, and check the expiry badge.
- Optionally enter the secret to check whether the signature is valid.
An example token is filled in. Its secret is "onetooling-demo-secret", so you can try signature checking right away.
Questions
Is it safe to paste a real token here?
The token is decoded in your browser and never sent anywhere. Still, treat live tokens like passwords: anyone who has one can use it until it expires, so avoid pasting them into tools you do not trust.
Does decoding check that the token is genuine?
No. Anyone can read a JWT, because the header and payload are only Base64-encoded. The signature is what proves who issued it. Enter the secret to check HS256, HS384, or HS512 signatures.
What do exp, iat, and nbf mean?
"exp" is when the token stops being valid, "iat" is when it was issued, and "nbf" is the time before which it must not be accepted. All are seconds since 1 January 1970; the tool shows them as dates in your time zone.
Can I check RS256 or ES256 signatures?
Not yet. Those need the issuer’s public key; this tool currently checks shared-secret (HMAC) signatures only.
Credits
Built by OneTooling using standard browser features. No third-party code runs on your data.