Support: JWT Decoder

Tell us what happened. Include which page you were on and what you expected to see. Most answers go out within a business day.

Common questions

Is it safe to paste a token here?

The token is decoded by code running in your browser and is never sent to us or stored. Even so, a token is a credential: prefer tokens from a test environment, and never paste a production secret anywhere you do not have to.

Does decoding verify the token?

No. Anyone can decode a JWT, because the header and payload are only base64url encoded. Verification needs the key: paste the secret or the public key under Signature and the check runs in your browser.

Why does it say the token is expired?

The exp claim is a Unix timestamp; when it is earlier than now, servers reject the token. The line shows how long ago it expired. Tokens are usually short-lived and refreshed by the app.

What does alg none mean?

The header claims the token is unsigned. Such a token can be written by anyone, so no server should accept it, and the decoder flags it.

Which algorithms can be verified?

HMAC with a shared secret (HS256, HS384, HS512), RSA with a public key (RS256, RS384, RS512 and PS256, PS384, PS512) and ECDSA with a public key (ES256, ES384, ES512). Paste the public key in PEM form, beginning BEGIN PUBLIC KEY.

Can it read an encrypted token?

No. An encrypted token (JWE) has five parts and needs the recipient's private key; the decoder tells you when it meets one.

Where do I get the public key?

From the issuer's key set, usually published at a JWKS address, or from your identity provider's settings. This tool does not fetch it, so nothing about your token goes to the network.

Is it free?

Yes, completely free, with no sign-up.