Skip to content
Kitvoo

JWT decoder

Read claims and expiry

JWT

Tokens and keys are processed only in your browser on this device. They are never sent to a server or kept in the URL, storage, or analytics.

Payload

How to use

  1. Paste a token into the JWT box. A leading “Bearer ” and any line breaks are removed for you.
  2. The header, payload, algorithm, and expiry status appear right away.
  3. Check exp, iat, and nbf as readable dates in the Time claims table.
  4. To check the signature, enter the secret or public key under Verify signature (optional) and press Verify.

FAQ

Is the token I paste stored anywhere?

No. Tokens and keys are decoded only within this page in your browser. They’re never sent to a server or kept in the URL, localStorage, or analytics, and unlike other tools, this one doesn’t save any settings either. For production tokens, it’s still a good idea to close the tab when you’re done.

Why can I read the token without a key?

A JWT’s header and payload are only Base64URL-encoded, not encrypted, so anyone with the token can read them. Never put secrets like passwords in the payload. The key is only needed to verify the signature, which proves the token hasn’t been tampered with.

Which algorithms can be verified?

HS256, HS384, and HS512 with a secret key; RS, PS, and ES (256, 384, 512) and EdDSA with a public key. Public keys can be PEM (BEGIN PUBLIC KEY), a certificate (CERTIFICATE), a JWK, or a JWKS; with a JWKS, the key matching the token’s kid and algorithm is picked. Tokens with alg set to none can’t be verified.

The secret is right, but it says the signature doesn’t match.

If your server stores the secret Base64-encoded, turn on “The secret is Base64-encoded” and try again. If it still fails, check that the token wasn’t cut off or altered when you copied it.

Why is the expiration date wrong?

exp, iat, and nbf are read as seconds since January 1, 1970 (UTC). A value written in milliseconds shows up as a date far in the future, and a non-numeric value is marked “Not a number of seconds.” Dates are shown in your device’s time zone.

It says this is an encrypted token (JWE).

A token with five dot-separated parts is a JWE, whose contents are encrypted. This tool only decodes signed tokens (JWS); a JWE has to be decrypted by a server or library that holds the decryption key.