🎫 JWT Decoder
Paste a JWT and read its header and payload instantly, with the expiry (exp) checked, all locally, which is the only safe way to inspect tokens.
decoded locally, signature NOT verified (that requires the secret/key)
How the jwt decoder works
A JWT is three Base64URL segments separated by dots: header (algorithm), payload (claims) and signature. The first two are just encoded JSON, decoding them requires no key, which this tool does locally, pretty-printing both and evaluating the exp claim against the current time. The signature is NOT verified: that requires the signing secret or public key and belongs on your server, not in a web page.
The privacy point is not optional here: a JWT often IS a live credential. Pasting one into a random website’s "JWT decoder" hands your session to that server. This decoder runs entirely in your browser, verify with the network tab, or go offline first.
Frequently asked questions
Does decoding a JWT require the secret?
No, header and payload are Base64URL-encoded JSON, readable by anyone. The secret is only needed to VERIFY the signature (i.e., prove the token wasn't tampered with), which this tool intentionally does not do.
Why does it say "signature NOT verified"?
Honesty: without your signing key, no client-side tool can check authenticity. Decoding shows what the token claims; verification (server-side, with the key) proves the claims are genuine.
What are iat, exp and sub?
Registered claims: iat = issued-at, exp = expiry, sub = subject (user id), all Unix timestamps where relevant. The tool converts exp to a date and flags expired tokens.
Is it safe to paste a production token here?
Here, yes, nothing is transmitted (the page works offline). As a rule though, treat live tokens like passwords: prefer expired or test tokens when debugging, wherever the tool runs.
Why does my token fail to decode?
Check for the three-part dot structure and complete copying, truncated middles are the usual culprit. Opaque (non-JWT) session tokens also exist and won't decode.
How do I tell if a token has expired?
Read the exp claim, a Unix timestamp in seconds. If exp is less than the current time (seconds since 1970-01-01 UTC), the token is expired. For example exp 1516239922 is January 2018, so any such token is long expired, the tool converts exp to a readable date and flags this for you.
What algorithms can appear in the header?
The alg field names the signature scheme: HS256/384/512 (HMAC with a shared secret), RS256/384/512 and PS256+ (RSA), and ES256/384/512 (ECDSA). A special value "none" means unsigned, treat any token presenting alg:none as untrusted, since it carries no signature at all.
Is a JWT the same as an encrypted token?
No. A standard signed JWT (JWS) is only Base64URL-encoded, so its payload is fully readable, the signature proves integrity, not secrecy. There is a separate encrypted form (JWE), but the common bearer token you see is a signed, readable JWS, which is why you must never store secrets in the payload.