JWT decoder

How to decode a JWT

1. Paste a JWT into Token. A leading "Bearer " is removed automatically.
2. Read the decoded header and payload. Expiry, issue and not-before times are shown as dates under dates.
3. To check the signature, paste the secret (HS256, HS384, HS512) or the PEM public key (RS, PS and ES algorithms) into Secret or public key. The status line says whether it's valid.

What's inside a JWT?

A JSON Web Token has three parts separated by dots. The header says how the token is signed, the payload holds the claims (who the user is, what they can do, when it expires), and the signature lets the server check that nobody has changed the first two. The header and payload are just Base64-encoded JSON, which is what this tool decodes.