Skip to content
Dogu SangjaToolboxAll tools

JWT DecoderBeta

Paste a JWT (JSON Web Token) to see its header and payload. The signature is never verified, and everything runs in your browser.

Signature NOT verified

This tool only reads the contents — it never verifies the signature. Never paste a production token or secret you don’t trust here.

Paste a JWT to see its header and payload decoded.

How to use

Paste a JWT string into the input box, and its header and payload appear as neatly formatted JSON. You’ll also see the signing algorithm, the actual date and time for each registered claim (exp, iat, nbf), and whether the token has expired or isn’t valid yet. Copy buttons let you grab the header or payload output directly. Nothing you paste is ever sent anywhere — it’s all processed inside this browser.

The three parts of a JWT

A JWT is made of three dot-separated parts: header.payload.signature. The header carries metadata such as the signing algorithm (alg) and token type (typ), while the payload carries the actual claims — things like a user ID, permissions, or an expiration time. Both parts are just Base64URL-encoded JSON, not encryption, so anyone can decode and read them. Only the final signature part is signed with a secret (or private) key, and it exists to confirm the header and payload haven’t been altered since they were issued.

Decoding is not the same as verifying

This tool only reads and displays the header and payload — it never verifies the signature. Verifying a signature requires the secret key (for HMAC-based algorithms) or public key (for RSA/ECDSA-based algorithms) belonging to whoever issued the token, and this tool neither accepts such a key nor makes any network call outside your browser. So the fact that the content displays correctly doesn’t mean the token is genuine or still valid. Never paste a production token, or a secret key you don’t fully trust, into this or any other online tool.

Registered claims (exp, iat, nbf)

The JWT standard (RFC 7519) defines a handful of standard claim names, including exp (expiration time), iat (issued-at time), and nbf (not-before time). All three are stored as a NumericDate — the number of seconds since January 1, 1970. This tool converts that number into a date and time in your locale, then compares it against the current time: an exp in the past is marked “Expired,” and an nbf still in the future is marked “Not yet valid.” This status is shown for reference only — actual access control must still be enforced by server-side verification.

Privacy

The token you paste and its decoded result are computed entirely inside this browser and never sent to a server. Keep in mind, though, that a JWT payload was never encrypted to begin with, so information like an email address, role, or internal ID inside it is readable by anyone, with or without this tool.

Sources

Frequently asked questions

Does decoding a JWT also verify its signature?

No. Decoding only turns the Base64URL-encoded header and payload back into readable text. Checking whether the signature is genuine requires the issuer's secret key (or public key), and this tool has no verification feature — it never accepts a secret key at all.

I see a token with alg set to "none" in the header — is that dangerous?

Yes, very. With alg set to none, anyone can craft a token with any content and no signature at all. If a server blindly trusts such a token, authentication can be bypassed entirely. Check that your server explicitly rejects the none algorithm.

If I paste an expired token (exp in the past), does this tool block it?

No. This tool only displays whether a token has expired — it never blocks or invalidates the token itself. Rejecting expired tokens is something the server that uses the token must handle during its own verification.

Is it safe to share a decoded token with someone else?

It's not recommended. A JWT's payload isn't encrypted, only Base64URL-encoded, so anyone can read it with or without this tool. If it contains personal data such as an email address or user ID, or internal permission details, sharing the token means sharing that information too.