JWT Decoder
Paste a JSON Web Token to read its header and payload, with timestamps turned into real dates and expiry checked against right now. The token is decoded in this tab and never transmitted, which matters, because the tokens people paste into decoders are usually live credentials.
JWT decoderPaste a token, and it is decoded here and never sent anywhere
Common questions
- Is it safe to paste a real token into a decoder?
- Only into one that does not transmit it, and you cannot tell by looking. This tool decodes entirely in your browser. You can disconnect from the network and it still works, which is the only real proof. Even so, treat any token you have pasted anywhere as potentially exposed and rotate it if it grants meaningful access.
- Does decoding a token verify it?
- No, and conflating the two is the most common and most dangerous misunderstanding. The payload is base64, not encryption, so anyone holding the token can read it. The signature is what proves the contents were not altered, and checking it requires the signing secret or public key, which belongs on your server and never in a web page.
- What does “alg: none” mean?
- It declares that the token is unsigned, so its contents can be changed by anyone. It exists in the specification but it is effectively an attack when it appears in the wild: a server that accepts such a token will trust whatever an attacker puts in the payload. This tool flags it prominently.
- What do exp, iat and nbf mean?
- They are Unix timestamps in seconds. exp is when the token expires, iat when it was issued, nbf the earliest moment it is valid. All three are shown here as readable dates with a relative time, because a raw number like 1893456000 tells you nothing at a glance, and whether the token is expired is usually the whole question.
- Can I put secrets in a JWT?
- No. The payload is readable by anyone who holds the token, including the browser it is stored in and anything that intercepts it. Put an identifier in the token and keep the sensitive data on the server behind it.
- Why does my token fail to decode?
- Almost always because it was truncated when copied. A JWT is three dot-separated parts and browsers often select only part of a long string. This tool says which part failed and how many parts it found, and it strips a leading “Bearer ” automatically since that is how tokens are usually copied from a request header.
Decoding is exact. It reads the token but does not verify the signature, which needs the issuer’s key. Never trust an unverified token’s claims.