JWT decoder

Paste a JSON Web Token and read its header, payload and signature. The three segments are color-coded, and time claims like exp are shown as real dates with an expired-or-valid verdict.

How to use

  • Paste the token — a Bearer prefix and surrounding whitespace are stripped automatically.
  • Press Decode. The header and payload are shown as formatted JSON; the signature is left untouched.
  • If the payload contains exp, iat or nbf, they are also listed below as local dates with a valid / expired badge.

A JWT is encoded, not encrypted

The first two segments are plain Base64URL — anyone holding the token can read them, including this page. That is by design: a JWT carries claims, and its security comes from the signature, which only a holder of the secret or private key can produce. Two consequences worth internalizing:

  • Never put secrets in the payload. Passwords, keys, PII — anything readable is compromised the moment the token leaks.
  • Decoding is not validating. This tool shows you what a token says. Only your backend, with the key, can prove the token was not forged.

What the three segments are

  • Header — the signing algorithm (alg, e.g. HS256 or RS256) and token type. Watch out for alg: none: a well-known historic vulnerability class.
  • Payload — the claims. Registered ones like iss (issuer), sub (subject), aud (audience) and exp (expiry) have agreed meanings; anything else is application-specific.
  • Signature — HMAC or a digital signature over the first two segments. Modifying either segment invalidates it.

FAQ

Can this tool verify the signature?

No, deliberately. Verifying requires the secret (HS*) or public key (RS*/ES*), and pasting a production secret into a web page is a habit worth avoiding. Decode here, verify in your backend.

Why does decoding fail?

A JWS has exactly three dot-separated segments. Extra dots (often from copy-pasting a URL), whitespace inside a segment, or a payload that is not valid JSON will all fail. Unsecured alg: none tokens legitimately have an empty third segment and decode fine.

The exp date says expired — is the token bad?

The check compares against your device clock. If the clock is right, an expired token will be rejected by any compliant validator too — that is what exp is for. Get a fresh token from your auth flow.

Is my token uploaded anywhere?

No. Decoding happens in your browser. Even so, treat tokens like passwords — decode test tokens here, not live production credentials.

Other tools

Base64 JSON Formatter Timestamp Hash Regex Tester Text Diff