JWT Decoder: Read JSON Web Token Header and Payload
Paste a JSON Web Token to see what is inside: the algorithm, the claims and when it expires.
- Works on your device. Nothing is uploaded.
- Free, no watermark
- No signup
How to use
- Paste the token (with or without "Bearer").
- Read the header and payload as formatted JSON.
- Check the issued and expiry times, shown in Indian time.
Good to know
A JWT has three parts separated by dots: header, payload and signature. The first two are only Base64url-encoded JSON, so anyone holding the token can read them. This tool decodes them and shows the iat, nbf and exp times in IST, with a clear expired or not-expired status.
Decoding is not verifying. The tool never checks the signature and never asks for your secret or key, so it cannot tell you whether a token is genuine. Your server must always verify tokens before trusting them. A token with alg "none" has no signature at all, and we warn you about it.
Tokens are passwords in disguise: anyone who has a valid token can act as that user until it expires. Use test tokens here, never real production tokens from live users, even though this page keeps everything in your browser. Encrypted tokens (JWE, five parts) cannot be read without the key.
Questions
Is it safe to paste my JWT here?
The token stays in your browser. Even so, never paste live production tokens into any website; use test tokens.
Can this tool verify the signature?
No, on purpose. Verification needs your secret, which should never leave your server.
Why can anyone read the payload?
JWT payloads are encoded, not encrypted. Do not put secrets in them.
What time zone are the dates in?
Indian Standard Time (IST). The token stores them as seconds since 1970 (UTC).
What is a JWE?
An encrypted token with five parts. It cannot be decoded without the key.