JWT Decoder
Read the header and claims inside a JSON Web Token, with expiry times worked out.
About this tool
Decodes the header and payload of a JSON Web Token and lists every claim, turning the timestamp claims into readable dates and saying whether the token has expired.
**A JWT is signed, not encrypted.** The payload is base64url and anyone holding the token can read it — including this page, and including anyone who gets hold of it in a log file or a browser's local storage. That is the most commonly misunderstood thing about the format, and it is why putting anything confidential in a JWT is a mistake.
**Signature verification is deliberately not offered.** Checking a signature needs the signing key, and a website asking you to paste a production key into a form is asking you to publish it. Verify in your own code, with your own library.
Nothing you paste here is stored unless you are signed in and save the run.
Common questions
Is it safe to paste a token here?
Treat any token you paste anywhere as compromised. It is decoded on the server and not stored unless you save the run, but a live session token should be rotated after being pasted into any website, including this one.
Why will it not verify the signature?
Because that needs your signing key, and no website should ask for one. A key pasted into a form is a key you have published. Verification belongs in your own code.
Can I hide data in a JWT?
No. The payload is base64, not encryption — it is encoding, and decoding it takes no key at all. If the data must stay private, either keep it server-side or use JWE, which is a different thing entirely.
What does alg: none mean?
An unsigned token. It was a legitimate part of the specification and became a well-known vulnerability, because a library that honours it will accept a token anyone can forge. Any token arriving with alg none should be rejected.