Is it safe to paste a JWT into an online decoder?

Only use a decoder that processes locally and does not send your token away. This page keeps the token and HMAC secret in the current tab; inspect DevTools Network or disconnect after the page loads to verify the processing boundary. Prefer a disposable or non-production token anyway, because browser extensions, clipboard history, and screen sharing are outside this page.

Ordinary signed JWTs are not encrypted. Their header and payload are base64url-encoded, so anyone holding the token can read the claims. The signature protects integrity, not confidentiality. Encrypted JSON Web Encryption tokens are a different format and are not decoded here.

How do I check when a JWT expires?

Read the exp claim as epoch seconds. This decoder converts it to your local date and time and shows a live countdown. It also checks nbf first, so a token that has not started its valid window is not mislabeled as active.

Can I decode a JWT without the secret?

Yes. Decoding needs no key because the header and payload are only base64url-encoded. The secret is required to verify HMAC signatures and establish that those encoded segments have not changed.

What does signature invalid mean?

The supplied secret may be wrong, the header or payload may have changed, the signature bytes may be different, or the selected HMAC algorithm may not match. A valid signature still does not prove that the issuer, audience, dates, or permissions are acceptable to your application.

JWT Decoder

Read every claim, check the expiry clock, and verify HMAC signatures in your browser.

runs entirely in your browser

Valid window: checking your local clock...

Clock format

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "iss": "allthedamn.tools",
  "sub": "demo",
  "aud": "developers",
  "name": "All The Damn Tools",
  "iat": 1787241600,
  "nbf": 1787241600,
  "exp": 1893456000,
  "jti": "demo-token"
}

Claims

Claim	Value
`iss`Issuer	allthedamn.tools
`sub`Subject	demo
`aud`Audience	developers
`jti`Token ID	demo-token
`exp`Expiration time	Raw epoch 1893456000 Local time Reading local clock... Relative Reading local clock...
`iat`Issued at	Raw epoch 1787241600 Local time Reading local clock... Relative Reading local clock...
`nbf`Not valid before	Raw epoch 1787241600 Local time Reading local clock... Relative Reading local clock...
`name`Custom claim	All The Damn Tools

Verify signature

Decoded and verified on your device. Your token never leaves this page. Your HMAC secret never leaves either. To verify that boundary, open DevTools Network and confirm that no request contains your input. Decoding and verification keep working offline after the page loads.

Decode a JWT without sending it anywhere

Decoding a JWT is base64url parsing, so it needs no server. This decoder reads the token in this browser tab and never puts the token or HMAC secret in a request, URL, log, or local storage. Open DevTools Network and edit the token to inspect that boundary yourself. Once this static page is loaded, decoding and HMAC verification keep working offline.

A non-production token is still the sensible choice. Browser extensions, screen sharing, clipboard history, and copied logs sit outside this page, so local processing removes a network hop without making every surrounding system safe.

Header, payload, and signature

A compact signed JWT has three base64url segments separated by dots: header, payload, and signature. The header names the signing algorithm and usually the JWT type. The payload carries registered claims such as issuer, subject, audience, and expiration alongside application-specific claims. The signature covers the original encoded header and payload.

JWTs are encoded, not encrypted. Anyone holding an ordinary signed JWT can decode its header and payload without a secret. The signature provides an integrity check; it does not hide the claims. Do not put a password, API key, or other secret in the payload.

Check JWT expiry as a real time window

The exp, nbf, and iat claims are NumericDates measured in epoch seconds. This tool shows each as its raw value, your local date and time, and a live relative reading. The status line gives nbf precedence when a token is not valid yet, then reports an expired or active exp window.

The table also explains iss (issuer), sub (subject), aud (audience), and jti (token ID), while keeping custom claim values intact. A missing or malformed exp claim is called out rather than silently treated as a token that never expires.

Decoding is not verification

Readable claims are still untrusted input. For HS256, HS384, or HS512 tokens, open Verify signature and supply the shared HMAC secret. Verification hashes the original encoded header and payload with Web Crypto, checks the signature bytes, and refuses a selected algorithm that disagrees with the header.

A valid signature only proves that the token matches that secret. A server must still allow the algorithm, trust the issuer and audience, enforce exp and nbf with its clock-skew policy, and apply authorization rules. RSA, ECDSA, and remote JWKS verification are intentionally outside this HMAC-only checker.

A focused jwt.io alternative

jwt.io is a mature general-purpose debugger and remains useful when you need its broader algorithm and editing workflows. This page is intentionally narrower: local decoding, a claim-by-claim time table with a live countdown, and explicit HS256, HS384, and HS512 verification in one compact instrument.

fair questions

Is it safe to paste a JWT into an online decoder?: Only use a decoder that processes locally and does not send your token away. This page keeps the token and HMAC secret in the current tab; inspect DevTools Network or disconnect after the page loads to verify the processing boundary. Prefer a disposable or non-production token anyway, because browser extensions, clipboard history, and screen sharing are outside this page.
Are JWTs encrypted?: Ordinary signed JWTs are not encrypted. Their header and payload are base64url-encoded, so anyone holding the token can read the claims. The signature protects integrity, not confidentiality. Encrypted JSON Web Encryption tokens are a different format and are not decoded here.
How do I check when a JWT expires?: Read the exp claim as epoch seconds. This decoder converts it to your local date and time and shows a live countdown. It also checks nbf first, so a token that has not started its valid window is not mislabeled as active.
Can I decode a JWT without the secret?: Yes. Decoding needs no key because the header and payload are only base64url-encoded. The secret is required to verify HMAC signatures and establish that those encoded segments have not changed.
What does signature invalid mean?: The supplied secret may be wrong, the header or payload may have changed, the signature bytes may be different, or the selected HMAC algorithm may not match. A valid signature still does not prove that the issuer, audience, dates, or permissions are acceptable to your application.

Header

Payload

Claims

// Decode a JWT without sending it anywhere

// Header, payload, and signature

// Check JWT expiry as a real time window

// Decoding is not verification

// A focused jwt.io alternative

// fair questions

// related tools