JWT decoder
Paste a JSON Web Token to read its header and claims. Decoding happens in this tab; the token is never sent anywhere.
tool 02 of 12 []
all shortcuts ?
This tool decodes only. It does not check the signature, so a decoded token is not proof the token is genuine.
How to use it
- Paste the token. A leading "Bearer " is removed for you and line breaks are ignored.
- The header shows the signing algorithm (alg) and token type. The payload shows the claims.
- The time claims exp (expires), iat (issued at) and nbf (not before) are Unix seconds. They are shown as ISO dates, and the status line says whether the token is currently expired.
- To trust a token you must verify its signature with the issuer's key on your server. Decoding never does that.
Examples
Select an example to load it into the tool.
- HS256 sample (expired)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxNTE2MjQyNjIyfQ.signature - alg none (unsigned)
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ1c2VyLTEifQ.
Frequently asked questions
Is it safe to paste a real token here?
Decoding runs locally and nothing is transmitted, so the token does not leave your device. Still, treat live access tokens like passwords: prefer expired or test tokens when you can, and never paste them into tools that send data to a server.
Can this verify the signature?
No. Verification needs the secret or public key and must happen on your server. A JWT payload is only base64url encoded, not encrypted, so anyone holding the token can read it.
What do exp, iat and nbf mean?
exp is the time after which the token must be rejected, iat is when it was issued and nbf is the time before which it must not be accepted. All three are NumericDate values: seconds since 1970-01-01 UTC (RFC 7519).
Why does it say the token is not valid JWT?
A JWT is three base64url parts separated by dots. Common causes of failure are a truncated copy, extra characters, or an encrypted token (JWE), which has five parts and cannot be read without a key.
Why is alg "none" flagged?
A token with alg none carries no signature. Servers must never accept such tokens for authentication, so the tool warns you when it sees one.