Decode Base64 to text, preview images, detect file types and download the original file — with precise errors.
JWT Decoder
Paste a JSON Web Token to read its header and claims, check whether it has expired, spot security red flags, and optionally verify its signature — all in your browser.
Tokens, secrets and keys stay in your browser — nothing is sent or stored
How it works
A signed JWT is three Base64URL strings joined by dots: header.payload.signature. The decoder:
- splits the token and decodes the header and payload to JSON;
- lists every claim, explaining the registered ones (
iss,sub,aud,exp,nbf,iat,jti) and showing times as UTC dates and relative to now; - flags problems: an unsigned token (
alg: none), an expired or not-yet-valid token, a missing expiry, an issue time in the future, a very long lifetime, orexpin milliseconds; - optionally verifies the signature with the Web Crypto API: HMAC (HS256/384/512) with your secret, or RSA (RS*, PS*), ECDSA (ES*) and EdDSA with the public key.
Decoding shows you what a token says. Only a verified signature tells you it’s genuine, and only your server should decide whether to trust it.
Example
The sample token decodes to the header {"alg":"HS256","typ":"JWT"} and a payload for user 1234567890 (“Thandi Nkosi”, role editor), issued at 2025-10-09 08:53:20 UTC and expiring one hour later. That’s in the past, so the decoder warns that it has expired.
Open “Verify the signature” and enter the secret tooltarvern-demo-secret to see a valid signature. Change one character of the payload, or the secret, and verification fails.
Frequently asked questions
Is it safe to paste my token here?
This decoder runs entirely in your browser: the token, secret and keys are never sent to ToolTarvern or anyone else, and nothing is stored. Still, a JWT is often a live credential — anyone holding it can use it until it expires — so prefer test tokens, and never share production tokens in screenshots, tickets or chat.
Does decoding a JWT prove it’s genuine?
No. The header and payload are only Base64URL-encoded, so anyone can read — and anyone can write — them. Only verifying the signature with the right secret or public key proves the token was issued by whoever holds that key and hasn’t been altered.
Which algorithms can it verify?
HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, EdDSA, using your browser’s Web Crypto API. HS* tokens need the shared secret; RS*, PS*, ES* and EdDSA tokens need the public key as PEM (BEGIN PUBLIC KEY) or JWK — a JWKS works too, matched by kid. EdDSA requires a recent browser.
Can it decode encrypted tokens (JWE)?
No. A JWE has five parts and its payload is encrypted, so it can only be read with the decryption key. The decoder recognises JWEs and says so.
Why are exp and iat numbers?
JWT times are NumericDates: seconds since 1 January 1970 UTC. The decoder shows each as a date in UTC and relative to now, and warns if a value looks like milliseconds by mistake.
Related tools
Convert Unix timestamps to dates and back, in UTC, South African time or your local time zone.
Pretty-print or minify JSON with your choice of indentation and optional key sorting.
Generate random v4 or time-ordered v7 UUIDs in bulk, in the format you need.
Related guides
JWTs explained: structure, claims, decoding vs verifying, and common mistakes
How JSON Web Tokens work, what each part and claim means, why decoding isn't verifying, and the mistakes that cause real security bugs.
· 8 min read
JSON, Base64, URL encoding and HTML entities explained
What JSON, Base64, percent-encoding, HTML entities, UUIDs and Unix timestamps are for — and the common mistakes developers make with each.
· 7 min read
CSS colour formats explained: HEX, RGB, HSL, HWB and OKLCH
What each CSS colour format means, when to use it, why OKLCH is useful for palettes, and how to check colour contrast for accessibility.
· 7 min read