JWT Decoder
Decode a JWT's header and payload - free, no signup.
This decodes the header and payload only - it does not verify the signature. A token that decodes cleanly is not the same as a token that is genuinely valid; only the issuer's secret or public key can confirm that.
What this tool does
Paste your token and the header and payload are decoded instantly and shown as formatted JSON - no secret or key needed, because a JWT's header and payload are only base64url-encoded, not encrypted; anyone can read them. This tool also checks the exp claim and tells you plainly whether the token has expired. It does not verify the signature - that needs the issuer's secret or public key, which this tool never has, and a token that decodes cleanly is not the same as a token that is genuinely valid.
Decodes a JWT's header and payload from base64url into readable, formatted JSON.
Reads the exp (expiry) and iat (issued-at) claims where present and shows them as human-readable dates, flagging clearly if the token has expired.
Reports a clear error if the token isn't well-formed (wrong number of segments, or a segment that isn't valid JSON once decoded), rather than showing a blank or partial result.
Explicitly explains, rather than glossing over, that decoding a JWT is not the same as verifying it - a distinction many competing tools leave unsaid.
Requires exactly three dot-separated segments (header.payload.signature) and, if the token is malformed, reports precisely how many segments it actually found.
Displays the header's alg value as plain informational text and never acts on it - it's attacker-controlled content in an unverified token, not a trusted instruction.
How to use it
- Paste your JWT.
- Read the decoded header and payload.
- Check the expiry status shown alongside them.
Why use this decoder
A JSON Web Token is just encoded text, and reading its header and claims is the first step in debugging authentication. Seeing the expiry in a readable date saves guessing.
Why we built it
We built the JWT decoder to explain that decoding a token is not the same as verifying it, which many tools gloss over. Inspect the Base64 parts with the Base64 encoder and convert expiry values with the Unix timestamp converter.
If your task goes further, try the UUID Generator.
Who this tool is for
- Developers debugging authentication
- Security learners
- Support engineers reading a token
When to use it
- Debugging authentication and API issues.
- Checking when a token expires.
- Reading claims such as sub and scope.
- Learning the structure of a JWT.
Decoded is not the same as verified
A JWT is signed, not encrypted - which is exactly why no secret is needed to read it, and exactly why that isn't the same as trusting it.
A JSON Web Token has three parts: a header, a payload, and a signature. The header and payload are base64url-encoded JSON - readable by anyone with no key at all, which is precisely what this tool does. The signature is what proves the token hasn't been tampered with, and checking it requires the issuer's secret (for symmetric algorithms like HS256) or public key (for asymmetric ones like RS256) - something only the issuing system, or a system it's explicitly shared the key with, actually has.
That means anyone can decode and read a JWT's contents, but decoding it proves nothing about whether it's genuine. A tampered or forged token with a garbage signature decodes exactly as cleanly as a real one - the two are indistinguishable without checking the signature against the correct key, which is a server-side operation this tool deliberately does not attempt to fake.
Why the algorithm shown here is informational only
The header's alg field is just more unverified JSON - useful to look at, unsafe to trust.
This tool reads the header's alg claim (for example HS256 or RS256) and shows it alongside the decoded payload, purely so you can see what the token claims about itself. It never uses that value to attempt any verification, because the alg field lives inside the same unverified header as everything else - it's exactly as trustworthy as any other claim in a token nobody has checked yet, which is to say not trustworthy at all until the signature is verified.
This caution isn't theoretical: a well-documented historical class of JWT library bugs trusted a token's self-declared alg, including an "alg": "none" value meaning no signature at all - letting an attacker submit a completely unsigned, freely-editable token that a buggy library accepted as valid. See the companion guide, What a JWT actually is, for the full history.
What you give it, and what you get back
| Item | Details |
|---|---|
| Input | A JWT of three dot-separated parts. |
| Output | Header and payload as JSON, with dates for exp and iat. |
| Processing | In your browser; the token is not sent anywhere. |
Issues you may run into
| What you see | Why it happens | What to do |
|---|---|---|
| "Not a valid token" | It lacks three parts or has bad Base64. | Paste the full token without quotes. |
| Signature is not verified | Decoding does not verify. | Verify with your server's key. |
| Expired shows wrongly | Your clock is off. | Check device time. |
Assumptions and limitations
- This does not verify the signature - it only decodes the header and payload, which anyone can read regardless of whether the token is genuine.
- Expiry is calculated against your device's clock at the moment you check it, using the standard Unix-timestamp exp claim where present.
Frequently asked questions
How do I decode a JWT online for free?
Paste the token and the header and payload appear instantly as formatted JSON. No signup, no upload, no secret required.
Do I need the secret key to decode a JWT?
No - the header and payload are only base64url-encoded, not encrypted, so anyone can read them without a key. Only verifying the signature (proving the token is genuine) requires the secret or public key.
How can I tell if a JWT has expired?
This tool reads the standard exp claim (if present) and tells you plainly whether it's in the past, using your device's current time.
Can this tool verify my JWT is genuine?
No - verifying the signature requires the issuer's secret or public key, which this tool never has. A token that decodes cleanly could still be forged; only signature verification (typically done server-side) can confirm it's genuine.
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser - nothing is sent to a server, and closing the tab clears it.
Can I trust the algorithm this tool shows me?
As information about what the token claims, yes - it's read directly from the header. As proof of anything, no - the alg field is unverified content, and trusting a token's self-declared algorithm without checking the signature is a well-documented historical source of JWT vulnerabilities.
What does 'wrong number of segments' mean?
A JWT must be exactly three parts separated by two dots: header, payload and signature. If what you pasted has more or fewer than three parts once split on '.', it isn't a well-formed JWT, and this tool tells you how many segments it actually found.
Further reading
What a JWT actually is, and why decoding one isn't the same as trusting it — A JWT is three base64url sections stuck together with dots. Reading it needs no secret at all — which is why decoding one proves nothing about it.