Does decoding a token verify its signature or audience?

No. A JWT header and payload are encoded JSON, so they can be read without a secret or public key. This tool does not verify signatures, enforce an algorithm, validate issuer/audience or authorize a request. Expires in describes only the supplied exp value. A token with altered contents can display the same countdown. A verifier needs a trusted key and application rules.

What do exp, nbf, iat and auth_time mean?

They are numeric timestamps in seconds since the Unix epoch. exp is the expiration instant: the token is considered expired when the device clock reaches it. nbf names the earliest activation time, iat the issue time and auth_time an authentication time when supplied. The displayed comparison refreshes every second. Missing exp has no inferred expiry; nonnumeric or out-of-range time values are flagged and retained as raw claims. Clock skew and server policy are not applied.

How do I decode a Bearer token, cookie value or a refresh token?

Paste just the JWT value; a leading Bearer followed by whitespace is removed. Extract a cookie value yourself rather than pasting a whole Cookie header. A refresh token can be read only if it is a three-part JWT with JSON objects; opaque refresh tokens and encrypted five-part JWE values are not decoded. The tool does not read browser cookies, contact an issuer, refresh a token or change its expiration.

Can I read Google, Microsoft or RS256 tokens without a key?

You can inspect a supplied three-part JWT with readable JSON header and payload, regardless of the issuer or displayed algorithm. No provider account, key lookup or cryptographic verification is performed. Names and claims copied from the token are untrusted data, and an encrypted or opaque token needs its own format-specific workflow.

Can I encode a JWT or recover its signing secret?

No. There is no signing, encryption, decryption, key recovery or token-generation feature. Base64 Encoder can encode supplied text or bytes but does not create a signed token. An application must choose and enforce its own algorithm, trusted keys, audience, issuer, expiry and refresh policy.

What does alg: none or a missing signature mean?

alg: none declares an unsecured JWT. A token with another algorithm but an empty third segment also has no signature bytes. They are flagged separately and should be accepted only under an application policy that explicitly permits the appropriate unsecured format. Merely reading a token never grants it verified integrity.

Why does a token fail to decode?

Check the number of dot-separated parts, Base64URL characters and the JSON inside the header and payload. Both must be JSON objects rather than null, an array or a scalar. The error identifies the header or payload when decoding fails. Expired tokens can still be read, since reading claims is different from accepting a token.

Is the token uploaded, and can I use the decoder offline?

This tool processes the supplied token in the browser and does not transmit it. Its draft is saved in this browser's local storage; Clear token removes it. Once loaded, the decoder can continue without a connection. It is a manual inspection page, without a programming-language package, API, editor extension or application integration.

JWT Decoder

Paste a three-part JWT, with or without a Bearer prefix, to read its header and payload. Time claims become dates and are compared with this device clock every second. Copy header or payload JSON and inspect the raw signature. These are unverified claims: an expiry countdown does not establish a valid identity or authorization. The token is kept as a local browser draft until cleared.

JWT decoderReadyPaste a token, and it is decoded here and never sent anywhere

Token

Common questions

Does decoding a token verify its signature or audience?: No. A JWT header and payload are encoded JSON, so they can be read without a secret or public key. This tool does not verify signatures, enforce an algorithm, validate issuer/audience or authorize a request. Expires in describes only the supplied exp value. A token with altered contents can display the same countdown. A verifier needs a trusted key and application rules.
What do exp, nbf, iat and auth_time mean?: They are numeric timestamps in seconds since the Unix epoch. exp is the expiration instant: the token is considered expired when the device clock reaches it. nbf names the earliest activation time, iat the issue time and auth_time an authentication time when supplied. The displayed comparison refreshes every second. Missing exp has no inferred expiry; nonnumeric or out-of-range time values are flagged and retained as raw claims. Clock skew and server policy are not applied.
How do I decode a Bearer token, cookie value or a refresh token?: Paste just the JWT value; a leading Bearer followed by whitespace is removed. Extract a cookie value yourself rather than pasting a whole Cookie header. A refresh token can be read only if it is a three-part JWT with JSON objects; opaque refresh tokens and encrypted five-part JWE values are not decoded. The tool does not read browser cookies, contact an issuer, refresh a token or change its expiration.
Can I read Google, Microsoft or RS256 tokens without a key?: You can inspect a supplied three-part JWT with readable JSON header and payload, regardless of the issuer or displayed algorithm. No provider account, key lookup or cryptographic verification is performed. Names and claims copied from the token are untrusted data, and an encrypted or opaque token needs its own format-specific workflow.
Can I encode a JWT or recover its signing secret?: No. There is no signing, encryption, decryption, key recovery or token-generation feature. Base64 Encoder can encode supplied text or bytes but does not create a signed token. An application must choose and enforce its own algorithm, trusted keys, audience, issuer, expiry and refresh policy.
What does alg: none or a missing signature mean?: alg: none declares an unsecured JWT. A token with another algorithm but an empty third segment also has no signature bytes. They are flagged separately and should be accepted only under an application policy that explicitly permits the appropriate unsecured format. Merely reading a token never grants it verified integrity.
Why does a token fail to decode?: Check the number of dot-separated parts, Base64URL characters and the JSON inside the header and payload. Both must be JSON objects rather than null, an array or a scalar. The error identifies the header or payload when decoding fails. Expired tokens can still be read, since reading claims is different from accepting a token.
Is the token uploaded, and can I use the decoder offline?: This tool processes the supplied token in the browser and does not transmit it. Its draft is saved in this browser's local storage; Clear token removes it. Once loaded, the decoder can continue without a connection. It is a manual inspection page, without a programming-language package, API, editor extension or application integration.

Reads Base64URL JSON objects and finite numeric time claims against the device clock. Expiry status does not verify a signature, issuer, audience or authorization.