JWT Decoder
Paste a JSON Web Token to read its header and payload. Timestamp claims are expanded into readable dates, and the token never leaves your browser.
Your data never leaves your browser. This tool runs entirely on your device.
Paste a JWT to decode it.
How a JWT is structured
A JSON Web Token is three base64url-encoded segments joined by dots: header, payload and signature. The header names the signing algorithm, the payload carries the claims, and the signature proves the first two were not altered.
The first two segments are encoded, not encrypted. Anyone holding the token can read them — which is exactly what this tool does. Never put a password, an API key or anything else secret in a JWT payload.
header.payload.signature
Registered claims you will see
Most tokens use some of the standard claim names defined in RFC 7519:
- iss — issuer, who created the token.
- sub — subject, usually the user id.
- aud — audience, the service the token is meant for.
- exp — expiry time, as a Unix timestamp in seconds.
- nbf — not before; the token is invalid until this time.
- iat — issued at, when the token was created.
- jti — a unique id for the token, used to prevent replay.
This tool does not verify signatures
Decoding and verifying are different operations. Decoding just reads the payload; verifying recomputes the signature with the issuer's secret or public key to prove the token is authentic and unmodified.
Verification is deliberately not offered here, because it would require you to paste your signing secret into a web page. Verify tokens in your own backend, using a library that checks the algorithm against an allowlist — never trust the alg field in the header on its own.
Frequently asked questions
Is my token sent to a server?
No. Decoding happens entirely in your browser with no network request, so pasting a real token here does not expose it to anyone. Even so, treat any token you paste anywhere as worth rotating if it is still valid.
Can this tool verify a JWT signature?
No, and that is deliberate. Verifying requires the signing secret or public key, and asking you to paste a secret into a website would be poor practice. Verify server-side instead.
Why can everyone read my JWT payload?
Because base64url is an encoding, not encryption. The signature protects the token from being modified, not from being read. If a claim must stay confidential, do not put it in the token — or use JWE, which does encrypt the payload.
What does the exp claim mean exactly?
It is the expiry time as the number of seconds since 1 January 1970 UTC — seconds, not milliseconds, which is a common source of bugs. A token is rejected once the current time passes exp.
What does "alg: none" mean?
It declares an unsigned token. Accepting one is a well-known vulnerability: an attacker can strip the signature and set alg to none to forge any payload. Production verifiers should reject it outright.
Related tools
- Base64 DecoderDecode Base64 back to readable text. Standard and URL-safe alphabets both work, padded or not, and line breaks in pasted input are ignored.
- JSON FormatterPaste JSON to pretty-print it with consistent indentation, or minify it back down. Invalid JSON is reported with the exact line and column so you can find the problem.
- Unix Timestamp ConverterConvert a Unix timestamp to a readable date in every common format, or go the other way. Seconds and milliseconds are detected automatically.
- Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text simultaneously. Everything is computed in your browser.