JWT decoder
See what's inside a token, when it expires, and whether its signature holds up.
How it works
- 01Paste a token. A "Bearer " prefix and line breaks are fine.
- 02Read the color-coded header and payload, with dates turned into local time and an expiry badge.
- 03To check the signature, enter the secret (HS256/384/512) or paste the public key as PEM, certificate or JWK.
Questions
›Is it safe to paste a real token here?
Decoding and verification run in your browser with its built-in Web Crypto. The token, secret and key are never sent anywhere. Even so, treat live tokens like passwords and prefer expired or test tokens when you can.
›Does decoding prove a token is genuine?
No. The header and payload are only Base64URL-encoded, so anyone can read them and anyone can write new ones. Only a signature check with the right secret or public key shows that the token was issued by whoever holds that key and hasn't been changed.
›Which algorithms can it verify?
HS256, HS384 and HS512 with a shared secret; RS256/384/512 and PS256/384/512 with an RSA public key; ES256, ES384 and ES512 with an EC public key; and EdDSA (Ed25519) in browsers that support it. Keys can be PEM (PUBLIC KEY, RSA PUBLIC KEY or CERTIFICATE), a JWK, or a JWK Set, in which case the key matching the token's kid is used.
›What do exp, iat and nbf mean?
They are times in seconds since January 1, 1970 (UTC). exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. They are shown here in your local time with how long ago or how soon each one is.
›Is my data uploaded anywhere?
No. This tool runs entirely in your browser, and Rounder never sends what you type or drop in to a server, ours or anyone else's. Once the page has loaded, along with any AI model the tool uses, it even works offline.