JWT Decoder
Decode a JWT to read its header, payload and claims, with readable expiry dates and warnings such as alg none. Decoding only: nothing is verified or uploaded.
Decoding is not verifying. Anyone can read a JWT, and anyone can forge one that looks valid. This page never checks the signature, so do not treat what you see here as proof of who issued the token.
Paste a token above to see its header, payload and claims. Nothing is sent anywhere.
Processed locally in your browser. Your data never leaves your device.
About this JWT decoder
A JSON Web Token (JWT, RFC 7519) is a compact way to pass claims between systems, most often as an access or ID token in an Authorization: Bearer header. It has three Base64url parts separated by dots: a header describing the algorithm, a payload of claims, and a signature. This tool splits a token, decodes the header and payload, lists the claims, and turns the time claims into readable dates.
How to use it
- Paste a token. A
Bearerprefix, quotes and line breaks are handled for you. - Read the header, the payload and the claims table.
- Check the status line: it says whether
expandnbfmake the token expired or not yet valid right now.
Common claims
ississuer,subsubject,audaudience,jtitoken ID.expexpiry,nbfnot valid before,iatissued at. All three are Unix times in seconds.- Anything else (roles, scopes, email) is defined by the issuer. Claim values are shown as plain text and never as links, so a hostile URL in a token cannot be clicked from here.
Decoding is not verifying
- Do not trust a decoded token. Trust comes only from verifying the signature, the issuer, the audience and the expiry on your server.
- Never accept alg none, and pin the algorithms you allow, so an attacker cannot switch a token from RS256 to HS256 or to none.
- Payloads are not secret. Do not put passwords or personal data in a JWT unless it is also encrypted.
Frequently asked questions
- Does decoding a JWT verify it?
- No. A JWT is just Base64url-encoded JSON, so anyone can read it and anyone can create one that looks real. Only checking the signature with the issuer’s key (or shared secret) proves it was not forged or changed. This tool decodes only.
- Is it safe to paste a real token here?
- Decoding happens entirely in your browser and the token is never uploaded, stored or logged. Even so, a live token is a credential: prefer expired or test tokens, and revoke or rotate any token you have pasted into a tool you do not trust.
- What does alg none mean?
- The header says the token is unsigned. That is only legitimate in very specific setups. A server that accepts alg none as proof of identity can be tricked by anyone, so this tool shows a warning whenever it sees it.
- Why does it say my token expired?
- The exp claim is a Unix time in seconds. This tool compares it with your device clock. If your clock is wrong, or the issuing server’s clock is, the answer will differ from what the server decides; most servers also allow a small clock skew.
- What is the difference between JWS and JWE?
- A signed token (JWS) has three dot-separated parts and a readable payload. An encrypted token (JWE) has five parts and its contents cannot be read without the key, so it cannot be decoded here.