Decode a JWT
Paste a JSON Web Token to read its header and payload, see whether it has expired, and check which algorithm signed it. Decoding happens in your browser.
What it checks
- Header: alg, typ and kid.
- Expiry: exp as a readable date, with how long is left or how long ago it lapsed.
- Validity window: nbf and iat, which is where a clock skew between two services shows up.
- Lifetime: exp minus iat, flagged when an access token lives longer than a day.
- Identity claims present in the payload: iss, aud, sub and jti.
- The alg value "none", which means the signature is empty and anyone can forge the token.
What is not stored
Nothing is stored and nothing is sent. This checker is JavaScript that runs inside your browser tab, so the value you paste never reaches h2check.org or any other server. Close the tab and it is gone.
Limits
- The signature is not verified. Verifying needs the signing key, and a production key pasted into a web page is a leaked key.
- Encrypted tokens (JWE, five parts) are not decoded.
- A token that decodes cleanly can still be rejected by your service. This tool reads the token, it does not trust it.
Procedures that explain the result
- How to check authorization header
- How to check JWT algorithm
- How to check JWT expiration
- How to decode JWT
- How to verify JWT signature
Put it on your own page
Link to it with the value filled in, and the checker runs as soon as the page opens.
<a href="https://h2check.org/tools/jwt/">Decode a JWT</a>