Home JWT decoder
JWT decoder
The signature is not checked. Expiry and alg: none are shown on their own.
Enter a signing key and a JWT is made.
Why this exists
A token attached to a login response can be read for who it names and when it expires, from the header and payload alone.
On the same screen you can mint a sample with HS256, RS256, or ES256 and see whether the shape matches what a client expects.
-
01How to use it
Paste a token into the decoder. It may start with Bearer.
In the encoder, an algorithm, a key, and a JSON payload make a token.
-
02What you get
If iat, nbf, or exp is a number, it is shown as a time.
If exp is before now, it is marked expired.
Enteredheader.payload.signature
alg HS256 typ JWT -
03Worth knowing
RS and ES need a PKCS#8 PEM private key. Make a sample key produces one in that form.
The decoder does not check the signature, so the contents on screen are not a reason to trust the token.
Questions
- QDoes it check the signature?
- ANo. It reads the header and payload, and warns when the signature is empty or alg is none.
- QCan I include Bearer?
- AYes. The leading Bearer and the space are removed before reading.
- QDoes the token leave this browser?
- ANo. Reading and signing finish in this browser.