Bearer Token Decoder
Paste the token from your Authorization: Bearer header to decode it. If it is a JWT, you will instantly see all claims, scopes, and expiry — no data leaves your browser.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What is a Bearer token?
A Bearer token is a type of access credential used in HTTP Authorization headers: Authorization: Bearer <token>. The name 'bearer' comes from RFC 6750 — whoever 'bears' (possesses) the token can use it. No additional proof of identity is required, which is why Bearer tokens must be kept secret and transmitted only over HTTPS.
Bearer tokens can be opaque strings or JWTs. When a Bearer token is a JWT, it is self-contained — the API can verify the token's validity by checking the signature without making a network call to the authorization server. This makes JWT Bearer tokens efficient at scale. When the Bearer token is opaque, the API must call the authorization server's introspection endpoint to validate it.
To use the decoder above, paste only the token value — not the full 'Bearer ' prefix. If the token is a JWT, you will see the decoded header, payload, and claims. Use the Signature tab to verify the token's cryptographic integrity.
Header
Specifies the token type (typ) and the signing algorithm (alg), such as HS256 or RS256. Base64Url encoded.
Payload
Contains the claims — statements about the subject such as sub, name, roles, and timestamps like iat and exp.
Signature
Created by signing the encoded header and payload with a secret or private key. Guarantees integrity.
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.