Does this JWT decoder verify the signature?

No. It decodes and displays the header and payload so you can inspect the claims, but it does not verify the cryptographic signature — that needs the signing key and belongs server-side. The output is labelled as unverified for exactly this reason.

Is it safe to paste a JWT here?

Decoding happens entirely in your browser and nothing is transmitted or logged. Still, treat any production access token as a live credential: if it may have been exposed elsewhere, rotate it.

Why can anyone read my JWT payload?

The payload is Base64URL-encoded, not encrypted. The signature proves the token wasn't tampered with; it does not hide the contents. Never put passwords, keys or personal data in a JWT payload.

What does 'alg: none' mean?

It declares the token unsigned. Libraries that honour it can be tricked into accepting forged tokens, so any server accepting alg: none is vulnerable. Treat it as a finding, not a curiosity.

How do I tell if a JWT is expired?

Compare the exp claim to the current time. This decoder does it for you and marks expired tokens explicitly.

JWT Decoder

Decode a JWT's header and payload, and inspect its claims, algorithm and expiry.

live · client-sideWeb, API & Tokensfree · no sign-up

RAW INPUT

DECODED

Output appears here as you type — decoded on your device.

Input is processed on your device. Nothing you paste is sent anywhere.

What is the JWT Decoder?

A JWT decoder splits a JSON Web Token at its dots and Base64URL-decodes the header and payload, revealing the algorithm that signed the token and the claims it asserts.

A JSON Web Token (RFC 7519) is three Base64URL-encoded parts joined by dots: a header naming the signing algorithm, a payload carrying the claims, and a signature over the first two. Because the first two parts are only encoded, anyone holding a token can read exactly what it says — which is the point of this decoder, and the reason secrets must never go in a payload.

The claims follow conventions worth knowing: iss (who issued it), sub (who it is about), aud (who it is for), exp (when it stops being valid), iat (when it was issued) and nbf (when it starts being valid). Times are Unix timestamps in seconds, so this decoder converts them into readable dates and flags a token that has already expired.

The header's alg field is equally worth a look. HS256 means a shared secret; RS256 and ES256 mean asymmetric keys. An alg of none is a red flag — it is the classic JWT vulnerability, where a server is tricked into accepting an unsigned token.

JWT Decoder at a glance

Specification: RFC 7519 (JWT) · RFC 7515 (JWS)
Structure: header.payload.signature — Base64URL, dot-separated
Encrypted?: No — the payload is readable by anyone holding the token
Time claims: exp, iat, nbf — Unix seconds, converted here

How to use the JWT Decoder

1Paste the full token, including both dots — a Bearer prefix is stripped for you.
2Read the decoded header and payload, with exp / iat / nbf rendered as dates.
3Check the alg field and the expiry warning before trusting what the claims say.

When you would reach for it

Debugging a 401 by checking whether the token expired or targets the wrong audience.
Confirming which scopes, roles or tenant a token actually carries.
Reviewing a token during a security assessment for weak algorithms or leaked data.

JWT Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools