Kodigo Labs ToolsHow to decode a JWT
Paste the token into the box. A JWT has three parts separated by dots: the header, the payload and the signature. The first two are decoded and shown as formatted JSON straight away. The time claims exp, nbf and iat are shown as dates in your time zone, with how long until the token expires or how long ago it expired.
To check that the token is genuine, use Verify signature. For HS256, HS384 and HS512 enter the shared secret. For RS, PS, ES and EdDSA tokens paste the issuer's public key; many identity providers publish it as a JWKS at an address ending in /.well-known/jwks.json, and you can paste that JSON as it is.
Example
Press Sample. It creates a fresh HS256 token signed with the secret my-secret-key that expires in one hour. The header shows "alg": "HS256", the payload shows "name": "Juan dela Cruz", and the time panel says it expires in 59 minutes. The secret is filled in, so verification shows a green tick. Change one letter of the secret and it turns red: that is what happens when a token is forged or signed with a different key.
Frequently asked questions
Is it safe to paste my token here?
This page decodes and verifies tokens entirely in your browser. The token, secret and key are never sent to a server, logged or saved. Even so, a valid token works like a password until it expires, so treat it with care: prefer test tokens, and do not share screenshots of real ones.
Does decoding a JWT prove it is genuine?
No. Anyone can read the header and payload, because they are only Base64url-encoded, not encrypted. A token can only be trusted after its signature is checked with the right secret or public key, and after its expiry (exp) and not-before (nbf) times are checked. Use the verification section for the signature.
Which algorithms can it verify?
HS256, HS384 and HS512 with a shared secret; RS256, RS384 and RS512, PS256, PS384 and PS512 with an RSA public key; ES256, ES384 and ES512 with an elliptic-curve public key; and EdDSA (Ed25519) in browsers that support it. Public keys can be pasted as a PEM public key, a PEM RSA public key, a PEM certificate, a JWK or a JWKS. Encrypted tokens (JWE) cannot be decoded without the private key.
Why does it say the token expired when it still works?
The times are compared with your computer's clock. If your clock is off, or the server allows a few minutes of "leeway", the result can differ slightly. Also check that exp is in seconds; some systems wrongly put milliseconds there, which this page will point out.
What do iss, sub, aud, exp, nbf, iat and jti mean?
They are standard claims from RFC 7519: iss is who issued the token, sub is who it is about (usually a user ID), aud is who it is meant for, exp is when it expires, nbf is when it starts being valid, iat is when it was issued, and jti is a unique ID for the token. The three time claims are Unix timestamps in seconds.