Paste a JSON Web Token to read what is inside it: the signing algorithm, every claim in the payload, and whether it has expired.
How to use this tool
- Paste the full token — all three dot-separated parts.
- The header and payload are decoded and pretty-printed immediately.
- Standard time claims (
iat,exp) are shown as readable dates, with an expired flag when relevant.
Important: this decodes, it does not verify
A JWT has three parts: header.payload.signature. The first two are just base64url-encoded JSON — anyone can read them without any key at all. The signature is what proves the token was issued by who it claims, and verifying it requires the signing secret or public key.
This tool deliberately does not verify, because verification would mean either sending your token to a server or asking you to paste your signing secret into a web page. Neither is a good idea. Treat the payload here as what the token says, not what is proven true.
Nothing you paste leaves your browser. Even so, avoid pasting live production tokens into any online decoder, including this one — a token is a credential, and shoulder-surfing and screenshots are real.
Common claims
sub— subject, usually the user IDiss— issuer, who created the tokenaud— audience, who it is intended forexp— expiry, as a Unix timestampiat— issued at, as a Unix timestampnbf— not valid before this time
Related tools
- Base64 encoder & decoder — the encoding JWTs are built on
- Timestamp converter — read
expandiatvalues by hand - Hash generator — the digest family behind HS256 signatures
- Password strength checker — test the secrets you sign with
FAQ
Is my token sent to a server?
No. Decoding happens locally with atob and JSON.parse. There is no network request, and nothing is stored.
Why can anyone read my JWT?
Because JWTs are encoded, not encrypted. The payload is designed to be readable by the client. Never put passwords, card numbers, or other secrets in a JWT payload.
The token looks valid but my API rejects it — why?
Common causes: it has expired (exp in the past), the aud or iss does not match what the API expects, clock skew between servers, or the signature was made with a different key. This tool shows you the first three; only your server can check the fourth.
What does "alg: none" mean?
It means the token claims to be unsigned. This is a well-known attack vector — a correctly configured server must reject none outright. If you see it on a token you did not create, treat it as suspicious.
Can I edit and re-sign a token here?
No. Re-signing requires the secret key, and a tool that asked for your signing key would be a security hazard. Use a library on your own machine for that.
More developer tools
- Base64 Encoder & DecoderEncode text to Base64 or decode Base64 back to text, right in your browser. Handles emoji and accented characters correctly, with URL-safe output.
- HTML Entity Encoder & DecoderEscape HTML so tags display as text, or decode entities back into characters. Supports all HTML5 named entities, in your browser.
- Regex TesterTest a regular expression against sample text and see every match, capture group, and named group. Live results, no server round trip.
- URL Encoder & DecoderPercent-encode text for URLs or decode an encoded URL back to readable text. Choose component or whole-URL mode, all in your browser.