JWT Decoder
Paste a JSON Web Token to see its header, payload and claims, with expiry times in plain English. Decode only: your token never leaves this page.
Decode only. This tool reads the header and payload. It never verifies the signature and never sends your token anywhere: there is no upload, no logging and nothing is saved. Do not trust what a token says until your server has verified it.
Algorithm:
Claims
Signature
Not verifiedThis is shown as-is. Checking it needs the signing secret or public key, which should never leave your server. In Node.js: jwt.verify(token, secret) from the jsonwebtoken package.
How to use the JWT decoder
- Paste a JSON Web Token into the box, or press Sample. A leading
BearerorAuthorization:is removed for you. - The token is split into its three parts (header, payload and signature) and the header and payload are decoded from base64url JSON as you paste.
- Read the Claims table:
exp,iatandnbfare shown as dates in your time zone and in UTC, with how long ago or how soon. - Check the warnings (for example
alg: noneor a missingexp). The signature is not verified here: verify it on your server with the secret or public key.
Everything runs in your browser. Nothing you paste or type is uploaded or saved.
Frequently asked questions
Does this JWT decoder verify the signature or send my token anywhere?
No to both. It only decodes the header and payload, which are base64url-encoded JSON that anyone can read. Verifying needs your secret or public key, and that should only ever happen on your server, for example with jwt.verify() in the jsonwebtoken package for Node.js. The decoding runs in this page's JavaScript: the token is not uploaded, logged or saved.
Is it safe to paste a real JWT into an online decoder?
Only into one that decodes in your browser, like this one. A live access token works like a password until it expires, so never paste it into a site that sends it to a server. Prefer test tokens, or tokens that have already expired, when you share them for debugging.
If anyone can decode a JWT, what stops someone changing the payload?
The signature. It is computed from the header and payload with a key only the server knows (HS256) or holds privately (RS256, ES256). If one character of the payload changes, verification fails and the server rejects the token. That is also why you should never put secrets in a JWT payload: it is signed, not encrypted.