JWT decoder
Decode JWT header and payload locally. Signature is not verified.
How to use
A JSON Web Token (JWT, RFC 7519) usually consists of three parts separated by dots: a header, a payload and a signature. The first two are JSON encoded in Base64URL, a variant of Base64 that is safe in URLs and in JWTs is written without = padding. Paste a token and Decode shows the header and the payload as indented JSON. The signature is not decoded: it is binary data, not JSON.
The header names the algorithm (alg): HS256 uses a shared secret (an HMAC), while RS256 and ES256 are signatures made with a private key and checked with the matching public key. The payload holds the claims: the standard ones include iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at) and jti (token ID).
exp, nbf and iat are Unix timestamps in seconds. This tool shows them as numbers; to read one as a date, paste it into the Unix timestamp converter.
Decoding is not verification. Anyone can create a token with any payload, so a decoded token proves nothing until the application that receives it checks the signature with the right key, accepts only the algorithms it expects and checks exp and nbf. A token with alg set to none has no signature at all and should be rejected unless that is explicitly intended.
Base64URL is an encoding, not encryption: anyone who has a token can read its payload, which is why passwords and other secrets do not belong in it. Encrypted tokens (JWE) have five parts and cannot be read without the key, so this tool rejects them. Decoding happens in your browser; the token is not sent anywhere.
Example
Decodes a demonstration token. Reading its header and payload does not verify a signature or prove authenticity.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.signatureHeader {"alg": "HS256", "typ": "JWT"} and payload {"sub": "123"}.eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoiQW5hIiwiaWF0IjoxNzA0MDY3MjAwLCJleHAiOjE3MDQwNzA4MDB9.signaturePayload with iat 1704067200 and exp 1704070800: issued at midnight UTC on 1 January 2024 and valid for one hour.eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMjMifQ.Header {"alg": "none"} and an empty signature: an unsigned token, which a server should normally refuse.
Frequently asked questions
Is it safe to paste a production token?
Processing is local, but tokens may contain sensitive data. Prefer a redacted or expired token and never share a signing secret.
Can this tool tell me whether a token is valid?
No. It does not check the signature, the expiry or the issuer. Verifying a token needs the shared secret (HS256) or the issuer's public key (RS256, ES256), and is the job of the application that accepts it.
Why is the payload readable if the token is signed?
A signature protects against changes, not against reading. The payload is only Base64URL-encoded, so it is public to anyone who sees the token.
Why do I get an error?
The text is not a token whose first two parts decode to JSON. Check that the whole token was copied, without the word Bearer or quotes around it, and that it is not an encrypted JWE.