Home JWT decoder
JWT decoder
The signature is not checked. Expiry and alg: none are shown on their own.
Enter a signing key and a JWT is made.
Why this exists
A token attached to a login response can be read for who it names and when it expires, from the header and payload alone.
On the same screen you can mint a sample with HS256, RS256, or ES256 and see whether the shape matches what a client expects.
-
01How to use it
Paste a token into the decoder. It may start with Bearer.
In the encoder, an algorithm, a key, and a JSON payload make a token.
-
02What you get
If iat, nbf, or exp is a number, it is shown as a time.
If exp is before now, it is marked expired.
Enteredheader.payload.signature
alg HS256 typ JWT -
03Worth knowing
RS and ES need a PKCS#8 PEM private key. Make a sample key produces one in that form.
The decoder does not check the signature, so the contents on screen are not a reason to trust the token.
Questions
- QDoes it check the signature?
- ANo. It reads the header and payload, and warns when the signature is empty or alg is none.
- QCan I include Bearer?
- AYes. The leading Bearer and the space are removed before reading.
- QDoes the token leave this browser?
- ANo. Reading and signing finish in this browser.
How this page works it out
This page reads a JSON Web Token without checking the signature. The header and the payload are shown as JSON.
A secret can build a new HS256 token from the same header and payload. That new token is not proof that an older token’s signature was valid. If the algorithm is none or the signature is empty, the page says so.
An expiry, when present, is read as a number and shown in this device’s time zone. The secret and the token stay in this browser. Do not use this page as a server that verifies someone else’s token.