A little help goes a long way. Find a tool/

Security

JWT Decoder

Free JWT decoder: decode JSON Web Tokens to inspect the header, payload, expiry, and issued-at claims. Runs in your browser, no data sent anywhere.

YOUR WORKSPACEFree to use. No sign-up.
—
Paste a JWT above.

Deep dive guides

A LITTLE CONTEXT · 5 MIN READInside a JWT: Decoding the Token
All 1 related guides
  • Inside a JWT: Decoding the Token — What the three dot-separated parts of a JSON Web Token contain: base64url header and claims, the HMAC signature, and why decoding is not verifying.

How jwt decoder works

A JSON Web Token (JWT) is a compact, URL-safe way to transmit information between parties. It has three parts separated by dots: a header (algorithm and token type), a payload (claims like user ID and expiry), and a signature. Each part is base64url-encoded.

This decoder splits the token, base64url-decodes the header and payload, and parses them as JSON. It shows the decoded header, the decoded payload with all claims, the signature, whether the token is expired, whether its nbf (not-before) claim is still in the future, and the expiry and issue dates in human-readable form. Every result states plainly that the signature is NOT verified — decoding never proves a token is authentic — and unsigned tokens (header alg "none") are flagged.

JWTs are not encrypted — they are encoded. Anyone can decode them, but only the server with the secret key can verify the signature. Never put secrets in a JWT payload. This tool only decodes; it does not verify signatures. All processing happens in your browser.

Frequently asked questions

What is a JWT?
A JSON Web Token (JWT) is a compact token with three parts: header, payload, and signature, separated by dots. It is used for authentication and information exchange. The header and payload are base64url-encoded JSON.
Can this tool verify JWT signatures?
No. This tool only decodes the header and payload. Verifying a signature requires the secret or public key, which is not embedded in the token. Decoding is safe to do client-side; verification should be done server-side.
Is it safe to decode a JWT?
Yes. JWTs are encoded, not encrypted. Anyone can decode them. The signature prevents tampering but does not hide the contents. Never put sensitive data like passwords in a JWT payload.
How do I check if a JWT is expired?
The decoder checks the exp claim in the payload and compares it to the current time. If the current time is past the expiry, the token is marked as expired and the result carries an expiry warning. The nbf (not-before) claim is checked the same way: a token whose nbf is still in the future is flagged as not-yet-valid. Dates are shown in readable form.
Why does it warn about alg "none"?
alg "none" means the token has no signature at all — anyone could have written it. Server libraries have historically been tricked into accepting such tokens, so a decoder that silently shows an "unsigned" token as normal is a hazard. This tool keeps decoding it (that is the job) but labels it UNSIGNED and reminds you that no signature was verified for any token it decodes.

Related tools

Security

Hash Generator

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly.

 Security

HMAC Generator

Generate HMAC-SHA256/SHA-1/SHA-384/SHA-512 codes from a message and secret key.

 Developer

URL Parser

Break a URL into protocol, host, path, query, and fragment.