Darnly
Free tools

JWT decoder: what’s inside your token?

Paste a JSON Web Token to see if it still works, when it expires, who it belongs to and what it’s allowed to do. It runs in your browser, so your token never leaves your computer.

Decoding the example token…

🔒 Your token never leaves your browser.

Try an example:

Check the signature

See the raw header and payload

The three parts of your token: header payload signature

Header

Payload
Every claim, explained
More free tools
How it works
  1. Paste your token in the box. You’ll usually find it in your browser’s Network tab, in a request’s Authorization: Bearer … header, or in your auth provider’s dashboard. A Bearer in front is fine.
  2. The card at the top tells you straight away if the token still works, when it expires, who it belongs to and which service made it. Supabase, Firebase, Clerk, Auth0 and Cognito tokens are recognized and explained.
  3. To be sure nobody changed it, open Check the signature and paste your JWT secret, or a key set (JWKS) address. Open See the raw header and payload for every claim in plain words.
Questions
Is it safe to paste my token here?
Yes. The token is decoded in your browser and never sent anywhere, not even to us. When you check a signature with a JWKS URL, only that URL is fetched, never your token. Still, treat a live token like a password: anyone who has it can act as that user until it expires.
What is a JWT?
A JSON Web Token is a small signed note your auth provider gives your app after someone signs in. It has three parts separated by dots: a header (how it was signed), a payload (who the user is, their role, when it expires) and a signature that proves nobody changed it. Decoding it is easy; faking one without the key is not.
Why does it say my Supabase key is dangerous?
Supabase gives every project two keys. The anon key is public and fine in the browser when Row Level Security is on. The service_role key skips every security rule, so anyone who finds it in your frontend code can read and delete your whole database. Keep it on the server, and if it was ever public, rotate it in Supabase → Project Settings → API.
My token is expired. What should I do?
Auth tokens are meant to expire, often after an hour. Your app should refresh them automatically, which the Supabase, Firebase and Clerk SDKs do for you. If users get logged out or see 401 errors, check that your code uses the SDK’s current session instead of a token you saved once.
Where do I find my JWT secret?
In Supabase it’s under Project Settings → JWT Keys (the legacy JWT secret). Projects on the new signing keys use public keys instead: click “Use Supabase Auth’s keys” and we fetch them for you. Firebase, Clerk, Auth0 and Cognito always use public keys, and we fill in the right address.
Which algorithms can it check?
HS256, HS384 and HS512 with a secret; RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512 with a JWKS URL, a JSON Web Key or a PEM public key; and EdDSA in browsers that support Ed25519. Encrypted tokens (JWE, with five parts) can only be read by the server that holds the key.