Tools / JWT Decoder

JWT Decoder

Paste a JSON Web Token to read the header and claims, see whether it has expired, and optionally check the signature. The token and secret stay in this browser.

Stays in your browser Expiry in plain language HS256, HS384, HS512
Encoded

Paste a token

The three parts of this token

  • Header
  • Payload
  • Signature

Reading happens in this browser. The token is not uploaded.

Signature

Check the signature

No algorithm yet

Optional. The signature check runs in this browser and is not uploaded.

Header

Algorithm and token type

{}
Payload

Claims in the token

{}
Timing

Issued, valid from, and expires

exp
Not set
iat
Not set
nbf
Not set
About this tool

Free JWT decoder that explains expiry and checks the signature

TechMamba JWT Decoder helps backend developers, frontend developers, QA testers, API integrators, and support engineers read a JSON Web Token without guesswork. Paste a token to see the header and payload as readable JSON, with the three encoded sections colour-coded so you can tell the header, payload, and signature apart.

Issued, not-before, and expiry times are the usual source of confusion, because they are stored as a count of seconds rather than a date. This decoder converts each one into a readable date and a plain phrase such as three years ago, then labels the token Active, Expired, or Not yet valid so you can see at a glance why an API rejected a request.

If the token was signed with a shared secret using HS256, HS384, or HS512, paste that secret to check the signature. The secret can be plain text or base64url encoded, and the check runs in your browser. Tokens signed with RSA or ECDSA public key algorithms can still be read here, but their signatures are not verified.

The token and the secret stay on your device and are never uploaded. Remember that decoding a token proves nothing about it: a valid signature, together with the expiry, issuer, and audience claims, is what makes a token trustworthy.

JWT Decoder FAQ

What is a JSON Web Token?

A JSON Web Token, or JWT, is a compact string that carries a set of claims about a user or a request, signed so the receiver can tell it has not been altered. Web APIs commonly use one as an access token after a user signs in.

What are the three parts of a JWT?

A JWT is three base64url sections joined by dots. The header names the signing algorithm and token type, the payload holds the claims, and the signature proves the first two parts were produced with the right key. This tool colours each section so you can tell them apart.

Who should use a JWT decoder?

Backend and frontend developers, QA testers, API integrators, and support engineers debugging a login or authorisation problem. Reading the claims is usually the fastest way to see why an API returned a 401 or 403.

Is it safe to paste a JWT here?

The token and secret stay in your browser. Nothing is sent to TechMamba or any other server. Even so, treat production tokens as credentials and avoid pasting live tokens into any website you do not trust.

Does decoding a JWT verify it?

No. Anyone can decode the header and payload because they are only base64url encoded. A token is trustworthy only after its signature is verified with the correct key and its claims are checked.

Which signatures can this tool verify?

You can check HMAC signatures (HS256, HS384, and HS512) by pasting the shared secret. The check runs in your browser. Tokens signed with RSA or ECDSA keys can still be decoded, but not verified here.

Is a JWT encrypted?

A standard signed JWT is encoded, not encrypted, so anyone holding it can read the payload. Never put passwords, card details, or other secrets in the claims, and always send tokens over HTTPS.

What do exp, iat, and nbf mean?

exp is when the token expires, iat is when it was issued, and nbf is the earliest time it should be accepted. Each value is a count of seconds since 1 January 1970 UTC, and the tool shows the matching date.

What do iss, aud, and sub mean?

iss names the service that issued the token, aud names the service it was meant for, and sub identifies the user or account it describes. An API should reject a token whose issuer or audience does not match what it expects, even when the signature is valid.

What is the difference between HS256 and RS256?

HS256 signs with a single shared secret, so everyone who can verify a token can also create one. RS256 signs with a private key and verifies with a public key, which suits tokens issued by one service and checked by many. This tool can verify HS256, HS384, and HS512.

Why does the signature check fail?

The usual causes are the wrong secret, a secret that is base64url encoded while the tool is treating it as plain text, a copied token missing characters, or an algorithm other than HS256, HS384, or HS512. Switch the encoding option and re-copy the whole token before looking further.

My token looks expired but the API still accepts it. Why?

Expiry is judged against your own device clock, and many servers allow a small amount of leeway for clocks that drift. If the two disagree by more than a minute or so, check the time settings on your machine before suspecting the token.

Can I change a claim and re-sign the token here?

No. This is a read-only decoder and signature checker. Editing the payload would invalidate the signature, and any service that validates tokens correctly would reject the result.