JWT Decoder
Decode a JWT header and payload, inspect its claims, and see expiry warnings. Decoding is not verification, and this tool says so plainly.
Three dot-separated Base64URL segments: header.payload.signature
How it works
- Paste a JWT. A "Bearer " prefix is accepted and ignored.
- The header and payload are Base64URL-decoded and formatted in your browser.
- Standard claims are interpreted, and expiry or unsigned tokens are flagged.
Frequently Asked Questions
Does this verify the token?
No. Decoding a JWT does not prove it is authentic. Verifying the signature requires the issuer’s key, which this tool does not have and will never ask for. A decoded token may have been forged or altered — always verify signatures on your server.
Is my token sent anywhere?
No. The token is split and Base64URL-decoded in your browser. There is no network request, no JWKS fetch, and the token never appears in analytics.
What does alg "none" mean?
That the token is unsigned, so anyone can create or modify it. It is a classic vulnerability when an application accepts such tokens, and this tool raises a critical warning whenever it sees one.
Why does it say my token is expired but not invalid?
Because only the server can decide. The tool reads the exp claim and tells you the time has passed; whether the token is rejected depends on the verifying application and its clock-skew allowance.
Can it decode an encrypted token?
No. A JWE has five segments and an encrypted payload that cannot be read without a key. The tool detects that shape and says so rather than showing partial nonsense.