Zvaad Tools

JWT Decoder

Paste a JSON Web Token to see its header, payload and claims, with exp, iat and nbf shown as dates and how long until the token expires. The tool always says whether the signature was checked: decoding alone proves nothing about who created a token. HS256 tokens can be verified here with their secret. Tokens are processed only on your device.

Runs in your browser · Tokens never leave your device

Loading the tool…

Tip: you can paste the whole Authorization header value, including "Bearer ".

How to use the JWT Decoder

  1. Paste the token. A leading "Bearer " is removed automatically.
  2. Read the claims and the expiry status in the summary.
  3. For HS256 tokens, enter the secret to check the signature.
  4. Copy or save the decoded result if you need it.

What the result means

NOT VERIFIED
The content was decoded, but the signature was not checked. Treat the claims as unconfirmed.
VERIFIED
The HS256 signature matches the secret you entered, so the token was created with that secret and not changed.
INVALID
The signature does not match: the token was modified, or the secret is wrong.
NONE
The token uses alg "none" and has no signature. Servers should reject such tokens.
Times
exp, nbf and iat are seconds since 1970 (UTC). The expiry status compares exp with your device’s clock.

Examples

These outputs were produced by the same code that runs in the tool above.

Decode a token without verifying

The payload and claims are readable, but the signature is reported as not verified.

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjdXN0XzEwMjQiLCJuYW1lIjoiQW1pbmEgUmFobWFuIiwicm9sZSI6ImVkaXRvciIsImlhdCI6MTc5Mzc4NjQwMCwiZXhwIjoxNzkzNzkwMDAwfQ.sK5b7Zso2MGSgHJ4kI3ysKSscx_XO5pGC74OETi183c

Decoded

HEADER
{
  "alg": "HS256",
  "typ": "JWT"
}

PAYLOAD
{
  "sub": "cust_1024",
  "name": "Amina Rahman",
  "role": "editor",
  "iat": 1793786400,
  "exp": 1793790000
}

CLAIMS
  Subject          cust_1024
  Name             Amina Rahman
  role             editor
  Issued at        2026-11-04T10:00:00Z  (30 minutes ago)
  Expires          2026-11-04T11:00:00Z  (in 30 minutes)

SIGNATURE
  Algorithm: HS256
  NOT VERIFIED. The signature was not checked. Decoding shows the content, but anyone can create a token with any content. Enter the HS256 secret to verify it here.
  • The secret, if entered, stays on your device and is not saved.

Verify an HS256 token with its secret

The same token checked with the secret zvaad-demo-secret.

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjdXN0XzEwMjQiLCJuYW1lIjoiQW1pbmEgUmFobWFuIiwicm9sZSI6ImVkaXRvciIsImlhdCI6MTc5Mzc4NjQwMCwiZXhwIjoxNzkzNzkwMDAwfQ.sK5b7Zso2MGSgHJ4kI3ysKSscx_XO5pGC74OETi183c

Decoded

HEADER
{
  "alg": "HS256",
  "typ": "JWT"
}

PAYLOAD
{
  "sub": "cust_1024",
  "name": "Amina Rahman",
  "role": "editor",
  "iat": 1793786400,
  "exp": 1793790000
}

CLAIMS
  Subject          cust_1024
  Name             Amina Rahman
  role             editor
  Issued at        2026-11-04T10:00:00Z  (30 minutes ago)
  Expires          2026-11-04T11:00:00Z  (in 30 minutes)

SIGNATURE
  Algorithm: HS256
  VERIFIED: the HS256 signature matches the secret you entered.
  • The secret, if entered, stays on your device and is not saved.

Frequently asked questions

Is it safe to paste a real token?

The token is decoded on your device and is not sent anywhere. Remember that a valid token is a credential: anyone who has it can use it until it expires.

Why can I read the token without a key?

JWT payloads are only Base64URL-encoded, not encrypted. Do not put secrets in them.

Can it verify RS256 or ES256 tokens?

Not in this version. Those need the issuer’s public key and should be verified by your server or authentication library.

Limitations and edge cases

  • Only HS256 signatures can be verified here.
  • Encrypted tokens (JWE) cannot be decoded without the key.
  • Expiry is calculated with this device’s clock.

Read the privacy policy for how the site handles data.