webtools

JWT Decoder

Private: nothing leaves your browser

Decoded as you type

Paste a token above to read what is inside it.

Paste a JSON Web Token to read its header and payload, see every claim explained in plain words, and find out whether it has expired. The token is decoded on your own device, so a live access token is safe to paste here.

About this JWT decoder

A JSON Web Token is three base64url chunks joined by dots: a header saying how it was signed, a payload of claims, and a signature over the first two. The payload is not encrypted. Anyone holding the token can already read it, which is exactly why you should never put a password or a card number in one. This page does that reading for you and labels each claim, so you can see who issued the token, who it is for and when it stops working. Each chunk on its own is ordinary base64url, which the Base64 decoder will open if you want to see the raw bytes rather than the labelled claims.

The decoding is JavaScript on this page. Your token is never sent anywhere, never logged and never stored, so pasting a live access token from your own app carries no more risk than looking at it in your terminal. The same page keeps working with your connection switched off.

How to decode a JWT

  1. Paste the token. An Authorization: Bearer ... header pasted whole works too: the prefix is stripped for you.
  2. Read the status line first. It tells you whether the token is still valid, and by how long it missed if not.
  3. The claims list shows every field with the timestamps turned into real dates and each standard claim explained.
  4. The header and payload panes give you the raw JSON, with a copy button on each.
  5. Press Load sample to see a complete token pulled apart.

Common questions about JWTs

Is it safe to paste a real token here?
Yes, in the sense that this page adds no risk: the decoding happens in your browser and the token is never transmitted, logged or saved. Treat the token itself with the same care you always would, since anybody who has it can use it until it expires. You can check that in a few seconds instead of trusting it: open the Network tab of your browser's developer tools and paste a token, and nothing appears, because nothing is sent. Disconnecting from the internet once the page has loaded and carrying on decoding makes the same point from the other direction.

Why does it not verify the signature?
Verifying means recomputing the signature, which needs the signing secret for HS256 or the issuer's public key for RS256 and ES256. Asking you to paste a production signing secret into a web page would be bad advice no matter who was asking, so this tool does not ask. Verification belongs on your server, in your auth library.

What do exp, nbf and iat mean?
They are timestamps in seconds since 1 January 1970, not milliseconds, which is the usual reason a hand-written token is rejected. iat is when it was issued, exp is when it stops being accepted, and nbf is the earliest moment it starts being accepted. This page converts all three to your local time and says how long ago or how far ahead that is.

My token will not decode. What is wrong?
Count the dots. Three parts is a JWT. Five parts is a JWE, which is encrypted and cannot be read without the key. Two parts usually means the token was truncated by a log line or a copy that stopped at the line break. If the parts are there but will not decode, the token has picked up a stray space or a quote character somewhere.

What does an algorithm of "none" mean?
It means the token is unsigned, and this page warns you when it sees one. It is a known attack: an attacker takes a real token, rewrites the payload, sets the algorithm to none and removes the signature. A correctly configured library rejects it, but libraries have shipped with that hole before, so it is worth knowing when you are looking at one.

Next

Related tools

All Dev tools
Base64 Decode Decode Base64 back to text, with full UTF-8 support. JSON Formatter Format, validate and minify JSON with clear error positions. Hash Generator MD5, SHA-1, SHA-256 and SHA-512 checksums of text or files. Base64 Encode Encode text or a file to Base64, or to a data URI.