JWT Decoder
Read what is inside a token.
FREE · NO SIGN-UP · RUNS ON YOUR DEVICE
The token never leaves your tab
- 2PARTS DECODED
- 3CLAIMS DATED
- 0SIGN-UP
- 1TAP TO COPY
JWT Decoder at a glance
- Decodes
- Header and payload
- Dates
- exp, iat and nbf
- Signature
- Shown, not checked
- Encoding
- Base64url
- Bad tokens
- Says what is wrong
- Price
- Free
- Account required
- None
- Where it runs
- On your device
How to use JWT Decoder
- 1
Paste the token
Paste the token.
- 2
Read the claims
Read the claims.
- 3
Check the dates
Check the dates.
Frequently asked questions
Does this check the signature?
No, and it will not offer to. Checking a signature needs the signing secret, and pasting a secret into a web page is not something this site will ask for.
Is my token sent anywhere?
No. The decoding happens in this tab and the token is never transmitted or stored.
Why is the payload readable without a key?
A JWT payload is only base64url encoded, not encrypted. Anyone holding the token can read it, which is why secrets do not belong in one.
What do exp, iat and nbf mean?
Expiry, issued at and not valid before. All three are seconds since 1970, which is why they are shown here as dates instead.
What a JWT actually protects
Paste a token and the header and payload appear as formatted JSON. The exp, iat and nbf claims are shown as dates, with how long ago or how long from now.
- The signature proves a token was not altered. It does not hide anything the token says.
- Anything in a payload should be treated as public, because anyone holding the token can read it.
- An expired token is still readable, which is why the expiry is shown as a date rather than a pass or fail.
- Verification belongs on the server that holds the key, not in a browser tab.
Full specification
| Decodes | The header and the payload, both pretty-printed as JSON. |
|---|---|
| Dates | Expiry, issued at and not before, shown as dates with how long ago or ahead. |
| Signature | Shown as it appears in the token, and not checked. |
| Encoding | Base64url, including tokens with the padding left off. |
| Bad tokens | Says which part failed to decode rather than showing an error trace. |
| Price | Free. Supported by clearly labelled ads placed outside the working area. |
| Account required | No. |
| Where it runs | In your browser tab. Nothing is sent anywhere. |
Keep going with the same files
All developer tools: Developer tools on SPOTTOOLS