# JWT decoder

Read a JSON Web Token without sending it anywhere

Use it at https://www.quicktoolz.com/tools/jwt-decoder. From QuickToolz.

A JWT is a signed token with three parts: a header, a payload and a signature. The first two are just encoded JSON, so anyone can read them. Paste a token to see its contents, with times in plain English. It’s decoded in your browser and never sent to us, and it isn’t stored.

## How it works

header.payload.signature, each in Base64URL

We decode the header and payload, and explain standard claims such as who issued the token and when it expires.

Checking a signature needs the secret key, and you shouldn’t paste that into a website.

Worked example: A JWT has three parts split by dots. The first two are JSON you can read. The third proves it hasn’t been changed, but only the key holder can check that.

## Examples

| Claim | Meaning |
| --- | --- |
| iss | Who issued it |
| sub | Who it’s about |
| exp | When it expires |
| iat | When it was issued |

## What this tool doesn't cover

- This reads a token. It doesn’t verify the signature, so don’t treat a decoded token as trusted.

## Questions

### Is it safe to paste a token here?

It’s decoded in your browser and never sent. Still, avoid pasting live tokens into any site where you can.

### Is a JWT encrypted?

Usually not. It’s signed, so anyone can read it, and only the signature proves it wasn’t changed.

### What does alg none mean?

The token has no signature, so it can’t be trusted.

### What are the three parts of a JWT?

The header, the payload and the signature, joined with dots. The first two are only encoded, so anyone can read them.

### Does decoding a JWT verify it?

No. Decoding only reads the token. To trust it, your server must check the signature with the right key.

## Sources

- [RFC 7519: JSON Web Token](https://www.rfc-editor.org/rfc/rfc7519)