JWT Decoder
Decode a JSON Web Token to read its header and claims, with expiry status. Decoding only, nothing leaves your browser.
Decode a JSON Web Token to inspect its header and payload. Decoding only - the signature is not verified, and nothing leaves your browser.
Token summary
- Subject
- 1234567890
- Claims
- 3
Signature is not verified - never trust a decoded token for authorisation.
{
"sub": "1234567890",
"name": "Jane Doe",
"iat": 1516239022
}About the jwt decoder
A JWT is three Base64url segments separated by dots: header, payload and signature. The first two are only encoded, not encrypted, so anyone holding the token can read them. That is by design, and it is why you must never put secrets in a JWT payload.
This tool decodes and shows the claims plus whether the token has expired. It does not verify the signature, because that needs the secret, and pasting a signing secret into a web page is exactly what you should not do.
How to use it
- 1Paste the token.
- 2Read the summary for subject and expiry.
- 3Switch between the payload and header tabs.
- 4Check exp against the current time.
Questions
Is the signature verified?
No, and deliberately so. Verifying requires the signing secret, and that should never be pasted into a browser tool. Verify on your server.
Is it safe to paste a token here?
Decoding happens entirely in your browser, so nothing is transmitted. Even so, treat a live token as a credential and prefer an expired or test one.
Why can anyone read the payload?
JWTs are signed, not encrypted. Signing proves the contents were not tampered with; it does not hide them. Never store secrets in the payload.