Encode & decode · Tokens
JWT Decoder
Split a token into header and payload, translate exp, iat and nbf into readable times, and verify an HS256 signature with your secret.
The token is parsed in your browser only and is never sent to any server. Note: decoding is not verification — a JWT is encoded, not encrypted, so anyone holding it can read the payload.
JWT token
Waiting for input
Header
—
Payload
—
Time claims
Once the token is parsed, this section lists readable times and remaining validity for iat / nbf / exp and friends.
Signature verification (HS256 / HS384 / HS512)