What does the JWT decoder do?

It splits and decodes the three parts of a JSON Web Token — header, payload and signature — and shows the header and payload content as readable, color-coded JSON, plus the expiration and signature status.

How does decoding work?

A JWT's header and payload are just Base64URL (not encryption). The tool decodes those parts to JSON and displays them. The signature stays encoded because it's a cryptographic hash used to verify integrity.

Is it safe to paste my token here?

Yes. All decoding happens locally in your browser via JavaScript. No token, secret or data is sent to ToolboxHub servers. Even so, avoid sharing valid production tokens publicly.

How do I verify the signature?

For tokens signed with HMAC (HS256, HS384 or HS512), enter the secret in the matching field: the tool recomputes the signature locally and tells you whether it matches. For asymmetric algorithms (RS256, ES256, etc.), verification would require the public key and isn't done here.

How do I know if the token is expired?

The tool reads the exp (expiration) and nbf (not before) claims from the payload, converts them to date/time in your timezone and shows a badge indicating whether the token is valid, expired or not yet valid.

Which algorithms are supported?

Decoding works with any JWT, regardless of algorithm. The built-in signature verification covers the HMAC algorithms: HS256, HS384 and HS512. Asymmetric algorithms are decoded but not verified.

Why isn't the payload encrypted?

A standard JWT is signed, not encrypted: anyone with the token can read the payload. The signature guarantees the content wasn't tampered with, but doesn't hide it. That's why you should never put sensitive data (passwords, cards) in a JWT payload.

Free Online JWT Decoder: Header, Payload & Signature

About the JWT Decoder

Paste a JSON Web Token (JWT) and see its three parts decoded in a structured, color-coded view: the Header (algorithm and type), the Payload (claims, expiration and scopes) and the signature. All decoding happens locally in your browser — the token is never sent to any server. For HMAC tokens, you can enter the secret and verify the signature. To generate hashes, use our Hash Generator.

How to decode in 3 steps

Paste the JWT into the input field.
See the Header, the Payload and the signature decoded automatically.
Check the expiration and, if the token is HMAC, enter the secret to validate the signature.

Structure of a JWT

A JWT has three Base64URL-encoded parts separated by dots: header.payload.signature.

Part	Color	Meaning
Header	Red	Metadata: signing algorithm (alg) and type (typ).
Payload	Blue	The claims: data about the user, permissions, issuance and expiration.
Signature	Teal	Guarantees the token's integrity; computed over header and payload with a secret key.

Registered JWT claims

The claims below are standardized by RFC 7519. Other (custom) claims may also appear in the payload.

Claim	Name	Meaning
`iss`	Issuer	Who issued the token (issuer).
`sub`	Subject	The token subject, usually the user ID (subject).
`aud`	Audience	The recipient(s) the token is intended for (audience).
`exp`	Expires at	Expiration date/time — after it the token should no longer be accepted (expiration).
`nbf`	Valid from	Date/time before which the token is not valid (not before).
`iat`	Issued at	Date/time the token was issued (issued at).
`jti`	Token ID	Unique token identifier (JWT ID).

JWT Decoder