Does the JWT decoder send my token to a server?

No. All decoding happens entirely in your browser using JavaScript. No tokens are sent to any server, making it safe to decode production tokens.

Can it verify JWT signatures?

The decoder displays the signature algorithm and payload claims but does not verify signatures, as that would require the signing secret or public key.

What JWT algorithms does it support?

The decoder handles all standard JWT algorithms including HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, and PS256.

Does it show token expiration?

Yes. The decoder highlights the exp (expiration), iat (issued at), and nbf (not before) claims and shows whether the token is currently valid, expired, or not yet active.

JWT Decoder & Inspector - Free Token Analyzer

Home
Developer Tools & Resources
JWT Decoder & Inspector

JWT Decoder & Inspector

Decode, inspect, and validate JSON Web Tokens securely in your browser

Paste your JWT token here:

Your token never leaves your browser. All processing is client-side.

Sample Tokens:

Header

Payload

Signature

Public Key (PEM format):

Token Analysis

Export

Frequently Asked Questions

What is a JWT token?

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. JWTs consist of three parts: header, payload, and signature, separated by dots. They’re commonly used for authentication and information exchange in web applications.

Is it safe to decode JWT tokens online?

This tool is completely safe because all decoding happens entirely in your browser. Your tokens never leave your device or get sent to any server. However, be very cautious with other online JWT tools that may send your tokens to their servers for processing. Always verify that tools are client-side only before using them with real tokens.

What does each part of a JWT mean?

A JWT has three parts separated by dots:
1. Header contains metadata about the token, like the algorithm used for signing
2. Payload contains the claims or actual data you want to transmit
3. Signature ensures the token hasn’t been tampered with and verifies the sender

How do I check if a JWT is expired?

Check the ‘exp’ (expiration time) claim in the payload. This contains a Unix timestamp. If the current time is greater than this timestamp, the token is expired. This tool automatically shows expiration status and provides a countdown timer for active tokens.

What’s the difference between HS256 and RS256?

HS256 (HMAC SHA-256) uses a symmetric algorithm where the same secret is used for both signing and verification. RS256 (RSA SHA-256) uses asymmetric encryption with a private key for signing and a public key for verification. RS256 is generally preferred for distributed systems since you can share the public key without compromising security.

Founded

2023 in London, UK

Contact

hello@releaserun.com