More
More
JWT Decoder & Encoder
Read a JSON Web Token, check an HS256 signature or sign a test token.
Free tools that run in your browser. Nothing you type, open or create is uploaded to NerdBible or anyone else.
Never paste production tokens or production secrets into any website. A valid token is a key to an account until it expires, and a signing secret lets anyone mint tokens your servers will trust. This page works in your browser and sends nothing, but the safe habit is to use expired tokens and development secrets only.
Paste a token to read it.
| Claim | Value | Meaning |
|---|
How to use it
- Paste a JWT. A leading Bearer is removed for you.
- Read the decoded header and payload, and the claims table with dates in your time zone and UTC.
- Check the status line to see whether the token has expired or is not valid yet. For an HS256, HS384 or HS512 token you can type a development secret to check the signature.
- To make a test token, open Encoder, edit the header and payload JSON, choose the algorithm and type a development secret. The signed token appears below, ready to copy or open in the decoder.
Questions
Is a JWT encrypted?
Usually not. A standard signed JWT is only Base64URL encoded, so anyone holding it can read the payload, as this tool shows. Never put secrets in a JWT payload.
Does this tool verify the signature?
Only for HMAC tokens (HS256, HS384 and HS512), and only when you type the secret. The check runs with your browser's Web Crypto API and nothing is sent. Use it with development secrets: a production secret should never be pasted into any web page. Tokens signed with RS, ES or PS keys are not checked here; verify those in your own code with a maintained library.
How do I create a JWT for testing?
Open the Encoder tab, edit the header and payload as JSON, pick HS256, HS384 or HS512 and type a test secret. The token is signed in your browser with HMAC. Set iat and exp from now fills in the issued and expiry times for a token valid for one hour.
What does the Base64URL secret option do?
Some systems store the HMAC secret as Base64URL text rather than plain text. Tick the box when yours does, so the secret is decoded to its raw bytes before signing or checking. If a signature fails to match, this setting is the first thing to try.
What do exp, iat and nbf mean?
exp is when the token expires, iat when it was issued and nbf the time before which it must not be accepted. All three are Unix timestamps in seconds.
Why does my token have five parts?
That is an encrypted token (JWE). Its header can be read, but the payload is encrypted and cannot be decoded without the key.
About this tool
About the JWT decoder and encoder
A JSON Web Token is three Base64URL encoded parts joined by dots: a header naming the algorithm, a payload of claims about the user or session, and a signature. Paste a token, with or without a leading Bearer, and the header and payload are shown as readable JSON.
What you see
- The decoded header and payload.
- A claims table with the standard fields explained and timestamps shown as dates in your time zone and in UTC.
- A status line saying whether the token has expired or is not valid yet.
- An optional signature check for HS256, HS384 and HS512 tokens when you type the secret.
Making test tokens
The Encoder tab signs a header and payload you write as JSON, using HMAC with SHA-256, SHA-384 or SHA-512 through your browser's Web Crypto API. One click fills in the issued and expiry times, and another opens the token in the decoder to check it. A secret can be plain text or Base64URL encoded.
Keep production secrets out of web pages
Use development secrets and expired tokens only. A signing secret lets anyone create tokens your servers will trust, so it should never be pasted into any website, even one that, like this page, sends nothing. Tokens signed with RSA or elliptic curve keys are not checked here; verify those in your own code with a maintained library.
The time claims
exp is when the token expires, iat when it was issued and nbf the time before which it must not be accepted. All three are Unix timestamps in seconds, a frequent source of bugs when code compares them with milliseconds.
Worth remembering
A standard signed JWT is encoded, not encrypted, so anyone holding it can read the payload. Never put secrets in a payload. A token with five parts is an encrypted JWE, whose payload cannot be read without the key.
Related tools
- Base64 Encode & DecodeEncode and decode Base64 text.
- Unix Timestamp ConverterTimestamps to dates and back, in any time zone.
- JSON Formatter & ValidatorPretty-print, minify and validate JSON.
- Hash Generator & File ChecksumSHA and MD5 hashes of text or files, HMAC signatures, and checking a download against its published checksum.
- RSA Key Pair GeneratorPublic and private keys, generated in your browser.