JWT Decoder
Read what is inside a token.
FREE · NO SIGN-UP · RUNS ON YOUR DEVICE
The token never leaves your tab
- 2PARTS DECODED
- 3CLAIMS DATED
- 0SIGN-UP
- 1TAP TO COPY
What you can count on
- 3claims as dates
- exp, iat and nbf read as dates
- With expired or expires in
- 0secrets asked for
- The signature is never checked
- Nothing asks you for a key
- 0uploads
- Nothing leaves the tab
- Nothing is stored
JWT Decoder at a glance
- Decodes
- Header and payload
- Dates
- exp, iat and nbf
- Signature
- Shown, not checked
- Encoding
- Base64url
- Bad tokens
- Says what is wrong
- Price
- Free
- Account required
- None
- Where it runs
- On your device
How to use JWT Decoder
- 1
Paste the token
An example token is already loaded so you can see the layout.
- 2
Read the claims
The header and payload appear as formatted JSON underneath.
- 3
Check the dates
Expiry and issue times are shown as dates, with how long ago or how long ahead.
Frequently asked questions
Does this check the signature?
No, and it will not offer to. Checking a signature needs the signing secret, and pasting a secret into a web page is not something this site will ask for.
Is my token sent anywhere?
No. The decoding happens in this tab and the token is never transmitted or stored.
Why is the payload readable without a key?
A JWT payload is only base64url encoded, not encrypted. Anyone holding the token can read it, which is why secrets do not belong in one.
What do exp, iat and nbf mean?
Expiry, issued at and not valid before. All three are seconds since 1970, which is why they are shown here as dates instead.
My token will not decode. What is wrong with it?
The message names which of five things failed: the wrong number of dot-separated parts, a header or payload that is not valid base64url, or a header or payload that decodes but is not a JSON object.
What a JWT actually protects
Paste a token and the header and payload appear as formatted JSON. The exp, iat and nbf claims are shown as dates, with how long ago or how long from now.
- The signature proves a token was not altered. It does not hide anything the token says.
- Anything in a payload should be treated as public, because anyone holding the token can read it.
- An expired token is still readable, which is why the expiry is shown as a date rather than a pass or fail.
- Verification belongs on the server that holds the key, not in a browser tab.
Full specification
| Decodes | The header and the payload, both pretty-printed as JSON. |
|---|---|
| Dates | Expiry, issued at and not before, shown as dates with how long ago or ahead. |
| Signature | Shown as it appears in the token, and not checked. |
| Encoding | Base64url, including tokens with the padding left off. |
| Bad tokens | Says which part failed to decode rather than showing an error trace. |
| Price | Free. Supported by clearly labeled ads placed outside the working area. |
| Account required | No. |
| Where it runs | In your browser tab. Nothing is sent anywhere. |
Keep going with the same files
All developer tools: Developer tools on SPOTTOOLS