JWT Decoder
Paste a JWT to see its decoded header, payload and expiry time. Decoding happens in your browser, so your token is not sent anywhere.
Paste a JWT to see its decoded header, payload and expiry time. Decoding happens in your browser, so your token is not sent anywhere.
A JSON Web Token (JWT) has three Base64URL parts separated by dots: a header, a payload with claims, and a signature. This tool decodes the header and payload so you can read the claims, and converts iat, nbf and exp into dates.
It decodes only. It does not verify the signature, so a decoded token is not proof that the token is genuine.
A JWT, specified in RFC 7519, is three Base64URL strings joined by dots. The header usually names the signing algorithm in the alg field and the token type. The payload carries claims such as iss for issuer, sub for subject, aud for audience and exp for expiry. The signature is computed over the first two parts with the algorithm in the header, using for example HMAC with a shared secret or RSA with a private key.
Because the first two parts are only encoded, not encrypted, anyone holding the token can read them. The signature only proves the content was not changed by someone without the key. Real validation must check the signature, the expected algorithm, the issuer, the audience and the expiry time. Known attacks include accepting the none algorithm or confusing an RSA public key with an HMAC secret, so servers should fix the allowed algorithms themselves.
No. Verification needs the secret or public key and should be done by your server. This tool only decodes.
Decoding happens in your browser and the token is not sent to a server. Still, treat real production tokens as secrets and prefer test tokens.
Issued at, not valid before, and expiration time. They are Unix timestamps in seconds.
The token is incomplete, has been altered, or is not a JWT. A JWT always has at least a header and a payload part.
The signature is raw binary output of a cryptographic operation, so it has no readable meaning. Only a server holding the correct key can check whether it matches the header and payload.
A signed token (JWS) is readable but tamper-evident. An encrypted token (JWE) hides its content from anyone without the key. This tool decodes the common signed form with readable parts.