Free Online JWT Decoder — Nothing Uploaded
Runs in this tab. A token, a key, a config — whatever you paste stays local.
Loading the tool…
How it works
RFC 7519, and what decoding does not prove
This tool decodes. It does not verify the signature. A decoded payload tells you what the token claims to say, and nothing about whether it is authentic or unmodified — anyone can craft a token with sub set to whatever they like, and it will decode perfectly. Verification requires the issuer's key and belongs on your server, using a library that checks the alg, the signature, exp and the audience together.
- Header
- First segment. JSON with alg (HS256, RS256, ES256) and typ, plus kid when the issuer rotates keys.
- Payload
- Second segment. The claims. Base64url-encoded JSON, not encrypted — never put anything secret in it.
- Signature
- Third segment, over header.payload. Shown here as bytes; checking it needs the key, which is a server-side job.
- exp / iat / nbf
- NumericDate claims: seconds since the Unix epoch, not milliseconds. Rendered here as local and UTC times so an expiry is readable at a glance.
- Base64url
- RFC 4648 §5 alphabet with padding stripped, which is why a JWT segment pasted into a standard Base64 decoder often fails.
How to use it
How to decode a JWT online
- 01
Paste the token
The whole thing, three segments separated by dots. Strip any Bearer prefix.
- 02
Read the header and claims
Timestamps are converted to readable dates so expiry is obvious.
- 03
Verify elsewhere
Treat what you see as unverified input until a server checks the signature.
Where it earns its keep
Where decoding a JWT helps
- Checking whether a 401 is an expired token or a missing scope.
- Confirming which issuer and audience an integration's token was minted for.
- Reading the kid to work out which signing key a service should be fetching.
- Seeing what claims your own auth provider actually puts in an access token.
Questions
JWT Decoder, answered
Does this verify the signature?
No. It decodes only. A valid-looking decode proves nothing about authenticity — the signature can only be checked with the issuer's secret or public key, and that check belongs in your backend, not in a web page.
Is it safe to paste a real token here?
Safer than anywhere that sends it off-device: decoding happens entirely in this browser tab and the token appears in no network request. Even so, a live token is a credential — prefer an expired one, and rotate anything you have pasted into tools you are unsure of.
Why can I read the payload without a key?
Because a signed JWT is encoded, not encrypted. The signature protects integrity, not confidentiality. If a claim must stay private, it does not belong in the token — use JWE or an opaque reference instead.
What does alg: none mean?
An unsecured token with no signature. It exists in the spec and has been the root of real authentication bypasses where libraries accepted it. Any verifier should reject it outright and pin the expected algorithm.