Skip to content
Toolore

Developer Tools

JWT Decoder

Decode a JSON Web Token to read what is inside it. Read the warning first: decoding a JWT does not verify its signature, and a decoded payload proves nothing about whether the token is genuine.

Decoding a JWT does not verify its signature

Anyone can create a token whose payload claims to be an administrator. Only checking the signature against the signing key proves a token is genuine, and this tool never does that — it cannot, because it does not have your key, and a website that asked for it should not be trusted. Never paste a production token you still rely on into any third-party site, including this one.

Paste a JWT to inspect its header and payload.

How to use this tool

  1. Read the warning above the input before pasting anything.
  2. Paste the token. The header and payload are decoded and the claims listed with their meanings.
  3. Expiry and not-before times are checked against the current time — but that is a check of what the token claims, not of whether it is authentic.

Formula and method

header . payload . signature

Three Base64url segments separated by full stops. The header and payload are plain JSON that anyone can read; only the signature — which requires the signing key to check — establishes that the token has not been altered.

Notes and limitations

  • Decoding a JWT does not verify its signature. This tool never verifies, because verification requires the signing key, and a website that asked for your key should not be trusted with it.
  • The header and payload are not encrypted, merely encoded. Anyone holding a token can read every claim in it, so a JWT must never carry a secret.
  • Never paste a production token you still rely on into any third-party website, this one included. Anyone with a valid token can act as that user until it expires.
  • A token with alg set to 'none' has no signature at all. Servers must reject those outright — accepting them is a well-known authentication bypass.
  • An unexpired token is not necessarily a valid one. Without checking the signature, the expiry date is simply a number the token asserts about itself.
  • Everything runs in your browser and nothing is uploaded. That said, treat any third-party website with caution when handling production data — if a value would cause real damage if leaked, process it with your own local tooling instead.

Frequently asked questions

Does this verify the token's signature?

No, and it never will. Verification needs the secret or public key used to sign the token. This tool decodes what is inside — it cannot and does not tell you whether the token is genuine.

Is a JWT encrypted?

No. The header and payload are Base64url-encoded JSON, which anyone can read. The signature prevents undetected modification, not disclosure. Never put anything confidential in a JWT payload.

Is it safe to paste a token into this page?

The decoding happens in your browser and nothing is sent anywhere. Even so, the safe habit is never to paste a live production token into any third-party site — use an expired or test token, or decode it locally.

What does 'alg: none' mean?

That the token is unsigned. It was intended for cases where integrity is guaranteed by other means, but accepting such tokens is a classic authentication bypass, so servers should reject them.

My token has expired — can I still read it?

Yes. Expiry is just a claim inside the payload, so an expired token decodes exactly like a current one. Only a server enforcing the expiry will refuse it.

Related tools