JWT Decoder
Read a JSON Web Token's claims and expiry, and check its signature.
Your text stays on your deviceHow?
How to decode a JWT
- Paste the token.
- Read the header, payload and claims, with dates in plain form.
- To check the signature, open Check the signature and paste the secret or public key.
Questions
Is my token sent anywhere?
No. The token is decoded inside your browser and never leaves your device.
What does alg none mean?
The token carries no signature, so anyone could have written it. A service that accepts such tokens can be fooled.
Which keys can check a signature?
For HS256, HS384 and HS512, the shared secret. For RS, PS and ES tokens, the public key as PEM or JWK, or the certificate as PEM.
Is the key kept?
No. It stays on this page while it is open and is never saved or sent.