HeaderPayloadSignature
Verify the signature
Paste a JSON Web Token and this viewer decodes it as you type. It shows the header and payload as formatted JSON, explains every claim in plain English, converts timestamps like exp and iat into real dates, and tells you at a glance whether the token is valid, expired, or not active yet. You can also verify the signature with a secret or public key. The token is decoded in your browser and never sent anywhere.
How to decode a JWT
- Paste the token into the box. You can paste just the token, a full
Authorization: Bearerheader, or a redirect URL that contains anid_tokenoraccess_token, and the token is pulled out for you. - Check the colored banner for the token's status and when it expires.
- Read the claims table for what each field means, or switch to JSON to see the raw payload.
- To confirm the token hasn't been tampered with, open Verify the signature and paste the secret or public key.
What's inside a JWT
A JWT is three Base64URL-encoded parts joined by dots: header.payload.signature. The header says how the token is signed, the payload holds the claims, and the signature proves the first two parts weren't changed. Decoding only needs Base64URL, which is why anyone holding a token can read it. Verifying needs the key.
| Claim | Name | What it means |
|---|---|---|
iss | Issuer | Who created and signed the token, usually an auth server URL |
sub | Subject | Who the token is about, usually a user ID |
aud | Audience | Which app or API the token is meant for |
exp | Expiration time | When the token stops being valid, in seconds since 1970 |
nbf | Not before | The token isn't valid before this time |
iat | Issued at | When the token was created |
jti | JWT ID | A unique ID for the token, used to stop replays |
The claims table also explains common OpenID Connect claims like email, nonce, and auth_time, OAuth claims like scope and client_id, and provider-specific claims from Microsoft Entra ID, Amazon Cognito, Auth0, Google, and Firebase.
Decoding vs. verifying
Decoding shows what a token says. Verifying proves it's genuine. Never trust a decoded token's claims on your server without checking the signature, because anyone can create a token with any payload. This viewer verifies all common algorithms:
| Algorithm | Key to paste |
|---|---|
| HS256, HS384, HS512 | The shared secret, as text or base64 |
| RS256, RS384, RS512, PS256, PS384, PS512 | An RSA public key in PEM format (BEGIN PUBLIC KEY or BEGIN RSA PUBLIC KEY), an X.509 certificate, a JWK, or a JWKS |
| ES256, ES384, ES512 | An EC public key in PEM format, a certificate, a JWK, or a JWKS |
| EdDSA | An Ed25519 public key in PEM format or as a JWK |
If you paste a JWKS with several keys, the key matching the token's kid is used automatically. Many providers publish their JWKS at a URL ending in /.well-known/jwks.json.
Security warnings the viewer checks for
- alg: none: an unsigned token can be forged by anyone and should always be rejected.
- Timestamps in milliseconds: JWT times must be in seconds. A value in milliseconds makes a token look valid for thousands of years.
- Issued in the future: usually a sign that the server clock is wrong.
- Sensitive data: claims named like passwords, card numbers, or social security numbers are flagged, because JWT payloads are readable by anyone with the token.
- Long-lived tokens: access tokens that last more than a day are flagged, since a stolen token stays usable until it expires.
Frequently asked questions
Is it safe to paste a real token here?
The token is decoded by JavaScript in your browser and never sent to a server, so it isn't exposed by using this page. A JWT can still act as a password until it expires, so avoid pasting live production tokens anywhere you don't trust, and don't share screenshots of them.
Can anyone read the contents of a JWT?
Yes. A standard signed JWT is only encoded, not encrypted, so its payload can be read by anyone who has it. The signature stops people from changing it, not from reading it. Encrypted tokens (JWE) have five parts instead of three, and this viewer shows their header and explains that the payload can't be decoded without the private key.
Why does it say my token is expired?
The exp claim is earlier than your device's current time. Tokens are short-lived on purpose, often 5 to 60 minutes. Get a new token from your login or refresh flow. If a token looks expired the moment it's issued, check that your device and server clocks are correct.
How do I verify a JWT signature?
Open Verify the signature and paste the key. For HS256 that's the shared secret. For RS256 or ES256 it's the issuer's public key, which you can usually copy from the provider's JWKS endpoint. The result shows right away and updates if you change the token.
What's the difference between an ID token and an access token?
An ID token tells your app who the user is, and its audience is your app's client ID. An access token is sent to an API to grant access, and its audience is that API. Both are often JWTs, and both can be decoded here.
Does it work with Auth0, Okta, Entra ID, Cognito, and Firebase tokens?
Yes. Any standard JWT can be decoded, and provider-specific claims like tid, oid, cognito:groups, and firebase are explained in the claims table.
Why is my token "not a valid JWT"?
A JWT needs three parts separated by dots, each in Base64URL. Common causes are a token that got cut off when copying, extra characters around it, or an opaque access token, which is a random string rather than a JWT and can't be decoded.