JWT Decoder & Validator

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three Base64url-encoded parts separated by dots: header.payload.signature. The header names the signing algorithm, the payload carries the claims (who the user is, when the token expires), and the signature lets the recipient verify the token wasn't tampered with.

What this tool shows you

Paste a token and it instantly decodes the header and payload into readable JSON, then interprets the standard time claims so you can see at a glance whether the token is still valid:

• exp — expiration time; the tool flags an expired token.
• nbf — "not before"; flags a token that isn't valid yet.
• iat — issued-at time, shown for reference.

The decoding is just Base64url + JSON — it does not prove the token is genuine. Anyone can read a JWT's payload, which is why you should never put secrets in it.

Verifying the signature

To confirm a token is authentic you must check its signature against the signing key. This tool can verify the most common case — HS256 (HMAC-SHA256) — directly in your browser: paste the shared secret and it recomputes the signature and compares. If it matches, the token was signed with that secret and hasn't been altered. Asymmetric algorithms (RS256, ES256) verify against a public key instead and aren't covered here.

Security notes

• The payload is readable by anyone. Treat it as public. Never store passwords, full card numbers or other secrets in claims.
• Always verify the signature server-side and reject tokens whose alg is none or doesn't match what you expect.
• Check expiry on every request. A decoded-but-expired token must be rejected.

Privacy

Tokens often contain real session data, so privacy matters: this decoder runs entirely in your browser and never transmits the token or secret. The Base64url parts are decoded with the same primitives behind our Base64 tool, and signature verification uses HMAC just like the HMAC generator.