Tools / JWT Decoder
JWT Decoder
Paste a JSON Web Token to inspect its header and payload. Decoding only — the signature is never verified, and nothing is sent to a server.
How it works: the header and payload are base64url-decoded and parsed as JSON entirely in your browser. No cryptographic verification is performed, so a valid-looking decode does not mean the token is authentic.
—
—
// About this tool
JWT Decoder
This JWT decoder takes a JSON Web Token and shows you exactly what's inside it: the header (signing algorithm and token type), the payload (claims like issuer, subject, and expiry), and a live readout of timestamp claims in human-readable form.
Decoding is done entirely in your browser with no upload and no server — which makes it safe to inspect tokens from development, staging, or production environments that you would not want to paste into an online service.
The decoder does not verify the signature, so a successful decode does not mean a token is authentic. It also flags tokens that declare alg: none, a well-known JWT vulnerability where a server that accepts unsigned tokens can be tricked into trusting a forged one.
// When to use it
Debug an auth failure during development
Paste the token your identity provider issued and check the alg, exp, and custom claims in one glance.
Inspect a suspicious token safely
Since decoding never leaves your browser, you can inspect a token from an unknown source without handing it to a third party.
Check whether a token is expired
Timestamp claims (exp, iat, nbf) are shown as readable UTC dates, with expired tokens flagged in red.
// Questions
Is my JWT uploaded to a server?
No. The token is decoded entirely in your browser. Nothing is uploaded and nothing is logged.
Does this tool verify the JWT signature?
No. This is a decoder, not a verifier. A successful decode only means the header and payload were valid base64url-encoded JSON — it does not prove the token is authentic.
What does the alg: none warning mean?
A token that declares alg: none claims to require no signature. Servers that do not explicitly reject this algorithm can be tricked into accepting a forged, unsigned token — a well-known JWT vulnerability class.
Why do timestamp claims look wrong?
JWT timestamps are Unix seconds. The decoder converts them to UTC dates for readability, so the values you see may differ from the raw numbers by your timezone.
// Related tools