JWT Decoder
Decode and inspect JSON Web Tokens (header, payload, signature, claims, expiration & security notices) safely in your browser.
What's Inside a JWT?
A JSON Web Token (JWT) is three Base64URL-encoded parts separated by dots — a header describing the signing algorithm, a payload of claims (like a user ID or expiration time), and a signature. This tool decodes and displays all three parts so you can inspect a token's contents.
How to Use the JWT Decoder
- Paste a JWT into the input field.
- The header and payload are decoded and displayed automatically.
- Review claim values such as expiration (exp), issued-at (iat), and subject (sub), along with the signing algorithm.
- Check the expiration status indicator to see if the token is still valid, expiring soon, or expired.
Technical Notes
- This tool decodes a JWT — it does not verify the signature. Decoding only reveals what a token claims; verifying that a token is authentic and untampered requires checking its signature against the correct secret or public key, which this tool intentionally does not do.
- Because a JWT's header and payload are only encoded (not encrypted), anyone who has the token can read its contents — never put secrets inside a JWT payload.
- A token with alg set to "none" has no signature at all and must never be trusted as authentic by any system.
Frequently Asked Questions
Does this tool verify that a JWT is authentic?+
No. It decodes and displays the header, payload, and claims, and flags expiry and alg=none, but it does not check the signature. A decoded token only shows what it claims; proving it is genuine requires verifying the signature against the issuer's secret or public key on your server.
Is the payload of a JWT encrypted?+
No. The header and payload are only Base64URL-encoded, so anyone holding the token can read them. Never place passwords, secrets, or sensitive personal data in a JWT payload.
What does "alg": "none" mean in a token?+
It means the token carries no signature at all. Such a token provides zero integrity or authenticity guarantees and must be rejected by any system that relies on JWTs for authentication.