Security

JWT Decoder — Inspect a JSON Web Token

Decodes a token’s header and payload, translates the time claims, and does not pretend to verify the signature.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the token. A leading "Bearer " is stripped for you.
  2. Select Decode.
  3. Read the exp row first — it is translated into a date, and the summary says whether the token has already expired.
  4. Remember that the signature is shown but not checked. Verification needs the key, and the key does not belong in a web page.

What jwt decoder does

A JWT is three Base64url segments separated by full stops: a header naming the algorithm, a payload of claims, and a signature. Only the signature is protected. The header and payload are encoded, not encrypted, and anyone holding the token can read every claim in it — which is the first thing to understand before putting anything into one.

This page decodes both readable segments, turns exp, iat and nbf from Unix seconds into dates you can read, and tells you whether the token has expired. It does not verify the signature, and it will not ask you for your signing key. Verification requires the key; a page that told you a token was valid without holding it would be lying, and a page that invited you to paste a production signing key into a text box would be worse than useless.

Frequently asked questions

No, deliberately. Verifying requires the signing key. A page that claimed a token was valid without holding the key would be lying, and one that asked you to paste a production signing key into a text box would be worse. The signature is shown, and reported as unchecked.

The decoding happens in your browser and the token is not transmitted. But be clear about what a token is: anyone holding it can act as you until it expires. Prefer an expired or test token, and if you paste a live one, clear the page afterwards.

No. The header and payload are Base64url-encoded, which is encoding and not encryption — anybody holding the token can read every claim. That is the first thing to know before putting anything into a JWT: put identifiers in it, not secrets.

That the token is unsigned, and the page flags it. Any system that accepts an alg of "none" is accepting a token anybody can forge by editing the payload. It is a well-known vulnerability class and never something to see in production.