JWT decoder
Read a JSON Web Token without sending it anywhere
Runs in your browser. Nothing is uploaded.
How it works
A JWT is a signed token with three parts: a header, a payload and a signature. The first two are just encoded JSON, so anyone can read them. Paste a token to see its contents, with times in plain English. It’s decoded in your browser and never sent to us, and it isn’t stored.
header.payload.signature, each in Base64URL
We decode the header and payload, and explain standard claims such as who issued the token and when it expires.
Checking a signature needs the secret key, and you shouldn’t paste that into a website.
Worked example. A JWT has three parts split by dots. The first two are JSON you can read. The third proves it hasn’t been changed, but only the key holder can check that.
Examples
| Claim | Meaning |
|---|---|
| iss | Who issued it |
| sub | Who it’s about |
| exp | When it expires |
| iat | When it was issued |
What this tool doesn’t cover
- This reads a token. It doesn’t verify the signature, so don’t treat a decoded token as trusted.
Questions
Is it safe to paste a token here?
It’s decoded in your browser and never sent. Still, avoid pasting live tokens into any site where you can.
Is a JWT encrypted?
Usually not. It’s signed, so anyone can read it, and only the signature proves it wasn’t changed.
What does alg none mean?
The token has no signature, so it can’t be trusted.
What are the three parts of a JWT?
The header, the payload and the signature, joined with dots. The first two are only encoded, so anyone can read them.
Does decoding a JWT verify it?
No. Decoding only reads the token. To trust it, your server must check the signature with the right key.
Was this useful?
Built by QuickToolz.
Sponsored
Advertise here10 spots leftSponsored
Advertise here10 spots left