Paste a JSON Web Token to read its header and claims and see when it was issued and when it expires. Add the secret or public key to check its signature. The token never leaves your browser.
A JWT is three Base64URL parts joined by dots: a header (the algorithm), a payload (the claims) and a signature. The first two are only encoded, not encrypted: anyone holding the token can read them, which is why this page can. Only the signature needs the key.
| Claim | Means |
|---|---|
iss | issuer: who made the token |
sub | subject: who it’s about, usually a user id |
aud | audience: who it’s for |
exp | expires: a Unix time after which it’s invalid |
nbf | not before: a Unix time before which it’s invalid |
iat | issued at: when it was made |
jti | a unique id for the token |
For HS256, HS384 and HS512, paste the shared secret (tick Base64 if yours is stored that way). For RS, PS and ES algorithms, paste the public key as PEM (-----BEGIN PUBLIC KEY-----) or a JWK. The check uses your browser’s Web Crypto, the same code banks’ web apps rely on.
A token with "alg": "none" has no signature at all, and this page says so: a server should never accept one.
The token and key stay in your browser: this page sends nothing anywhere, and works with your connection turned off. Still, treat live production tokens and secrets with care on any computer you share.
No. A JWE has five parts and can only be read with its decryption key. This reads signed tokens (JWS), the usual kind.
Its exp claim is a time in the past. Tokens are often short-lived (minutes to hours) on purpose; get a new one from the service that issued it.
HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512.
Open all 35 Dev Tools. Everything runs in your browser; nothing you paste is uploaded.