Is it safe to paste a token here?

The token is decoded in your browser and never sent anywhere. Still, a valid token is a credential: prefer pasting expired or test tokens, and rotate one you have shared anywhere you do not control.

Can it verify RS256 or ES256 tokens?

Not yet. It verifies HS256, HS384, and HS512 with a shared secret. Asymmetric tokens are decoded and inspected, but checking their signatures needs the issuer’s public key.

What do exp, nbf, and iat mean?

`exp` is when the token stops being valid, `nbf` is when it starts, and `iat` is when it was issued - all in seconds since 1970 (UTC). The tool shows them as dates and as time from now.

Free tool · no account

JWT decoder and inspector

Paste a JSON Web Token to read its header and claims, with expiry and issue times in plain dates. The tool flags unsigned and long-lived tokens and can verify HS256, HS384, and HS512 signatures with a secret you supply. Nothing leaves your browser.

Token

Paste a JWT to read its header and claims. Decoding needs no key - which is why a JWT must never carry a secret.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Keep the signing secret out of config files

Store signing secrets in Shortspan: encrypted, versioned, scoped to a project, and injected into the service when it starts with shortspan run.

Create a free workspace See what Shortspan does

Reading a JWT needs no key

A signed JWT is three base64url parts: a header, a payload of claims, and a signature. The first two are only encoded, so anyone holding the token can read them - which is why a JWT should never carry a password or other secret.

The signature proves the token was issued by someone with the key and has not been altered. For HMAC algorithms that key is a shared secret; for RS256 and ES256 it is a key pair, and checking it needs the public key. This tool verifies the HMAC algorithms.

What it warns about

alg: none means the token is unsigned and anyone can forge one. A missing exp claim means the token never expires on its own. A lifetime longer than a day means a stolen token stays useful for that long.

Common questions

Is it safe to paste a token here?: The token is decoded in your browser and never sent anywhere. Still, a valid token is a credential: prefer pasting expired or test tokens, and rotate one you have shared anywhere you do not control.
Can it verify RS256 or ES256 tokens?: Not yet. It verifies HS256, HS384, and HS512 with a shared secret. Asymmetric tokens are decoded and inspected, but checking their signatures needs the issuer’s public key.
What do exp, nbf, and iat mean?: exp is when the token stops being valid, nbf is when it starts, and iat is when it was issued - all in seconds since 1970 (UTC). The tool shows them as dates and as time from now.

More free tools