Uber Tools

JWT Decoder

Decode a JSON Web Token, read its claims and check its signature, the token never leaves your browser

Token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImFkbWluIjp0cnVlLCJpYXQiOjE3NjA0MDAwMDAsImV4cCI6NDEwMjQ0NDgwMH0.LBBODl04q3KfyRATlORnU0CsKT1t4YlR6pDuua5IdtA

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "Ada Lovelace",
  "admin": true,
  "iat": 1760400000,
  "exp": 4102444800
}

Claims

Not expired, expires in 73 years
Subject (sub)
1234567890
Expires (exp)
Thursday, December 31, 2099 at 5:00:00 PM PDT · in 73 years
Issued at (iat)
Monday, October 13, 2025 at 5:00:00 PM PDT · 1 year ago

Signature

Signed with HS256

Secret

The key stays in your browser, it isn't sent anywhere

How to decode a JWT

  1. Paste the JSON Web Token.
  2. Read its header and payload as formatted JSON, its three parts colored.
  3. See its claims explained: when it was issued and when it expires, and whether it's still valid.
  4. To check its signature, add the secret or the public key.

Questions

Can anyone read a JWT?

Yes: a JWT's header and payload are only Base64 encoded, not encrypted, so never put secrets in them. The signature only proves who made the token and that it wasn't changed.

How do I verify a JWT's signature?

Add the secret for HS256, HS384 and HS512 (as text or Base64), or the public key (PEM) or a JWK for RS, PS, ES and EdDSA tokens.

Why does it say my token has expired?

The exp claim is the time a token stops being valid; it's compared with your device's clock.

Is it safe to paste my token here?

Yes: the token and the key never leave your browser. Still, treat a live token like a password.

Related tools