JWT Decoder
Decode a JWT header and payload locally in your browser, including alg, typ, sub, iss, aud, iat, exp, and nbf claims.
Paste a test JWT to inspect the Header and Payload as readable JSON. Processing stays in your browser, and the tool does not verify signatures. Do not paste production tokens, real secrets, or private data.
Browser-local processing
JWT Decoder
How to use
Finish in three steps
- 01
Paste a JWT that is safe for debugging or documentation, not a production credential.
- 02
Click ?Decode JWT? to inspect the Header, Payload, signature segment, and common time claims.
- 03
Treat the output as a debugging clue; real authentication and authorization still require server-side verification.
What this decoder is for
Use it to inspect JWT Header, Payload, and common claims such as alg, typ, sub, iss, aud, iat, exp, and nbf. It does not call a backend, use external APIs, or decide whether the token is trustworthy.
Decode is not verification
JWT Header and Payload are usually Base64URL encoded, so anyone can decode them. A system should only trust a token after checking the signature with the right key and validating expiration, issuer, audience, and permissions.
Sensitive-token boundary
Browser-local processing is helpful, but you should still avoid pasting production tokens, admin sessions, customer data, private keys, or secret environment values. Prefer test tokens, redacted examples, or short-lived credentials with no real permissions.
FAQ
About this tool
Does this tool verify the JWT signature?
No. It only decodes Header and Payload and reports whether a signature segment exists. Verification requires a trusted secret or public key and should run on the server or in a controlled security environment.
Why should I avoid production tokens?
A production token can represent a real identity, tenant, permission set, or session. Even if this page does not upload input, browser extensions, clipboard history, screen recordings, or accidental sharing can expose it.
If exp is in the past, is the token definitely invalid?
The decoded exp value is only one signal. Acceptance also depends on server clock tolerance, signature verification, revocation policy, aud, iss, scope, and other checks.
What does alg none or an unexpected alg mean?
It is a security-review signal. This decoder only displays the field; servers must restrict allowed algorithms and verify signatures correctly.
Keep exploring
Related tools
Last updated: