Skip to main content
dubinity

Developer & Web

JWT Decoder

Read a JSON Web Token's header and payload, with expiry in plain language and optional HMAC verification.

  • Runs in your browser
  • Works on mobile
  • In: JWT
  • Out: JSON
Loading the tool…

Your files and text are processed on your own device, inside this page. Nothing is uploaded to Dubinity or stored, and closing the tab discards it. How privacy works

About JWT Decoder

Decodes the header and payload, which need no key - that is why a JWT must never carry secrets. Registered claims are explained: when the token was issued, when it expires and whether it has already done so.

If the token uses HS256, HS384 or HS512 you can paste the shared secret and the signature is checked in the page with WebCrypto. Public-key algorithms (RS, ES, PS) are reported but not verified, because that needs the issuer's public key.

How to use it

  1. 1Type or paste your text, or open a file.
  2. 2Choose any options - the result updates as you type.
  3. 3Copy the result or download it as a file.

Questions

Was this tool helpful?

Related tools

All developer tools

  • Base64 Decoder

    Decode Base64 back to text, or view the raw bytes as a hex dump when the data is not text.

    Base64
    Runs in your browserOpen tool

  • Hash Generator

    Hash text with MD5, SHA-1, SHA-256, SHA-384, SHA-512 or CRC-32, with HMAC and per-line options.

    TEXT
    Runs in your browserOpen tool

  • Secure Token Generator

    Generate API keys, session tokens and signing secrets with a chosen strength and encoding.

    NONE
    Runs in your browserOpen tool

  • JSON Formatter

    Format and indent JSON, or minify it, with exact error positions and big numbers kept as written.

    JSON
    Runs in your browserOpen tool

  • Password Generator

    Create strong random passwords with the character rules a site demands, and see the real entropy.

    NONE
    Runs in your browserOpen tool

  • What Is My IP

    See the IP address our server sees, the rough location attached to it and what your browser sends.

    NONE
    Server lookupOpen tool