WerklyTools
Esc
↑↓ navigate↵ open
EN
Buy me a coffee

JWT (JSON Web Token) decoder

Paste a JWT and see its header and payload as readable JSON, with the issue and expiry dates explained and the token status (valid, expired or not yet valid). For HMAC tokens you can check the signature with your secret. Everything happens in your browser: the token and the secret are not sent anywhere.

Processed 100% in your browser

Decoding is not verifying: anyone can read a JWT. Everything happens in your browser and the token is not sent anywhere.

Paste a token to decode it.

Ctrl + Enter runCtrl + C copy result

How to use

  1. 1Copy the token (the “Bearer ” prefix is fine) and paste it in the box.
  2. 2Read the header, the payload and the exp, iat and nbf dates with their status.
  3. 3To check the signature of an HS256, HS384 or HS512 token, enter the secret.
  4. 4Copy the header or payload JSON with the buttons.

Use cases

  • Debug why an API rejects a token: expired, wrong audience or missing permissions.
  • Review which claims a token carries before using it in an integration.
  • Check the expiry date of an access or refresh token.
  • Verify locally that an HMAC-signed token has not been tampered with.

Frequently asked questions

Is decoding a JWT the same as verifying it?

No. Anyone can read the content of a JWT because it is only Base64URL-encoded. Verification checks the signature and needs the key; without it you cannot know whether the token is authentic.

Is it safe to paste my token here?

The token is decoded in your browser and is neither sent to a server nor stored. Even so, avoid pasting production tokens with sensitive permissions into sites you do not control.

Which algorithms can I verify?

HS256, HS384 and HS512, which use a shared secret. RS256, ES256 and similar tokens are signed with a private key and verified with the public one, which this tool does not ask for.

What do exp, iat and nbf mean?

exp is the expiry moment, iat when it was issued and nbf from when it is valid. They are seconds since 1970 (Unix time) and you will see them here as a readable date too.

What is alg: none?

An unsigned token. It is a security risk if a server accepts it, so the tool warns you when it sees one.

Related tools

Base64 encoder and decoderConvert text or any file to Base64 and back. Supports the URL-safe variant, line breaks and data URI prefixes, and detects when decoded content is binary.
Code to imageCreate attractive code screenshots for social media, slides, blogs or documentation. Paste your code, pick a language, theme and background, and download a crisp PNG or a scalable SVG.
CSS minifier and beautifierShrink your stylesheets by removing comments, whitespace and empty rules, or do the opposite: turn minified CSS into readable, indented code. You will see the original size, the final size and the gzipped size.
JavaScript minifier and beautifierCompress your JS by stripping comments and whitespace and shortening names, or format a minified script so it is readable. Powered by Terser, right in your browser.
JSON formatter and validatorPaste your JSON to validate it, pretty-print it or minify it. If there is a syntax error, you will see exactly which line and column it is on.
Mock data generatorCreate fictional datasets to test your app, fill a database or prepare a demo. Define the fields, the number of rows and the output format.