Developer
Decode a JWT
A JWT is only encoded, not encrypted — anyone holding it can read the claims. This tool does exactly that, and additionally tells you whether the token has already expired.
HEADER
—
PAYLOAD
—
How to use it
- Paste the token, including both dots.
- Header and payload are decoded automatically as you type.
- Read exp / iat / nbf as human-readable UTC timestamps.
- Signature verification is not performed — see the note below.
What each of the three parts is for
Header, payload and signature, separated by dots. The header names the signing algorithm, the payload carries the claims, and the signature binds the first two to a key. Only the signature provides any security at all — the first two are Base64url, which is encoding, not encryption. Every claim you see here was readable by anyone who intercepted the token.
The mistakes that actually get exploited
Accepting alg: none lets an attacker strip the signature and have the token accepted. Trusting the algorithm named in the header instead of the one the server expects enables algorithm-confusion attacks, where an RSA public key is reused as an HMAC secret. And reading claims before verifying means an unverified payload gets treated as fact. Verify first, then read.
A pre-flight check before debugging a 401
Most authentication failures are visible in the payload before any code runs. Check three fields: exp against the current time, nbf if present (the token is not valid yet — the classic symptom of a server clock running fast), and aud or iss when a token issued for one service is presented to another.
Remember that decoding proves nothing. The signature is what makes a token trustworthy, and this page does not verify it — by design, since verification needs the key. Treat everything you read here as a claim, not a fact.
Frequently asked questions
Does this verify the signature?
No. Verification requires the secret or public key, and doing it in a browser would mean handing that key to a web page. Use your server-side library for verification; this tool is for reading claims while debugging.
Why does the payload look garbled?
The token is probably truncated or copied without its final segment. A JWT has three parts separated by two dots; anything else is not a complete token.
Is it safe to paste a production token?
Decoding happens entirely in this tab, so the token is not transmitted. Treat it as you would a password though — a leaked token is a leaked session until it expires.
What do exp, iat and nbf mean?
exp is the expiry time, iat the issue time, and nbf the earliest moment the token may be accepted. All three are Unix seconds in UTC.
Can this page verify a token's signature?
No, and it should not. Verification needs the signing key or public key, which never belong in a browser page.
Why is my token longer than the data it carries?
Header, payload and signature are each Base64URL-encoded separately, then joined with dots. Base64 adds roughly a third, and the signature is fixed-length regardless of payload size.