JWT Decoder
Decode a JSON Web Token and read its header, payload and expiry.
The token is decoded in your browser and is never uploaded, logged or stored anywhere.
A JSON Web Token is signed, not encrypted, so anyone holding one can read every claim inside it. This decoder does exactly that and nothing more: it splits the token on its dots, decodes the header and payload from base64url, and lays the registered claims out in a table. What it will not do is tell you whether the token is genuine.
More about JWT Decoder
Checking a signature needs the signing key, and this tool never asks for one. The signature is shown as it appears in the token so you can compare it against your own, and no part of the page ever calls a token valid. It does flag what can be read without a key: an algorithm of none, an empty signature, an expiry that has already passed, a not-before time in the future, an issued-at time in the future, and a payload with no expiry at all.
Times are the reason most people open a decoder. The exp, nbf and iat claims are rendered three ways at once, as a local timestamp, a UTC string and a relative phrase such as in three hours, so an expired token is obvious at a glance. A Bearer prefix and stray whitespace are stripped from whatever you paste, and a five-part JWE is identified as an encrypted token rather than failing with a parse error.
- Header and payload decoded from base64url and shown as formatted JSON
- Claims table covering iss, sub, aud, exp, nbf, iat and jti
- Time claims shown as local time, UTC and a relative phrase
- Warnings for expired tokens, a future nbf and a missing expiry
- An algorithm of none or an empty signature called out as unsigned
- Bearer prefixes and line breaks stripped from pasted tokens
- Five-part JWE tokens identified instead of misread as broken JWTs
- Copy or download the decoded header and payload as JSON
How to use it
- 1Paste the token into the box at the top, with or without its Bearer prefix.
- 2Read the claims table for the issuer, subject, audience and timestamps.
- 3Check the warnings above the tabs, such as an expired token or a missing expiry.
- 4Open the Header tab to see the algorithm and any key id the token declares.
- 5Copy the decoded payload from the Payload tab if you need it elsewhere.
Questions
Does this verify the signature?
No. Decoding needs no key but verifying does, and this tool never asks for one, so treat everything it shows as claims rather than facts.
Is my token sent to a server?
No. The token is split and decoded in your browser, and nothing about it is transmitted or stored.
Is it safe to paste a token here?
Any JWT can be read without a key, so a decoder gives away nothing the token does not already carry. A bearer token is still a live credential, so avoid pasting production tokens that are not yours.
Why does it say my payload is not JSON?
The spec allows any payload, and some systems put plain text or another format there. When that happens the decoded bytes are shown as text instead of a claims table.
What does an algorithm of none mean?
It means the token carries no signature, so anyone can write one that looks exactly the same. Reject those on the server rather than trusting the claims inside them.