JWT Decoder
Read a token's header, claims and expiry — without sending it anywhere.
Decoding is not verification.
Anyone can write a JWT that claims anything. Only the signature makes a token trustworthy, and checking it requires the signing key — which this tool deliberately never asks for. Read the claims here; never authorise anything based on them.
About the JWT Decoder
Paste a JSON Web Token to read its header, its payload and the registered claims — with iat, nbf and exp rendered as readable timestamps and the token's validity window resolved against your clock. The reason to decode a token locally is specific: a JWT is normally a working credential, and the usual way people read one is to paste it into a web page, which hands that credential to whoever runs the page. Nothing here is transmitted. The signature is shown but not checked, because verifying it needs the signing key, and no tool should ask you for that.
Is my token sent anywhere?
No. The decoder is JavaScript running in your browser and makes no network request. This matters more here than for most tools: a JWT is usually a working credential, and pasting one into a server you do not control hands over whatever it authorises.
Does this verify the signature?
No, deliberately. Verification requires the signing key, and a tool that asked you for your signing key would be asking for the secret that lets anyone forge tokens. Decoding tells you what a token claims; it proves nothing about whether those claims are authentic.
So a decoded token is not a trusted token?
Correct, and this is the mistake worth avoiding. Anyone can craft a JWT with any payload — the signature is the only thing that makes it trustworthy, and only your server, holding the key, can check it. Never make an authorisation decision based on a decoded payload alone.
Is the payload encrypted?
No. A standard JWT payload is Base64URL-encoded, not encrypted, so anyone holding the token can read every claim in it. Never put a secret in a JWT payload. (JWE is a separate, encrypted format and is not what most systems issue.)
What does "alg: none" mean?
An unsecured token with no signature at all. It should be rejected by any server in production — accepting one means accepting a token anybody could have written.
Why does it say my token is expired when it just worked?
The exp claim is compared against your device clock. If your clock is off, or the token was issued for a different leeway window, the two can disagree. The timestamps shown are what the token itself says.
Related: Base64 Encoder · Hash Generator · Timestamp Converter
Keywords: jwt decoder, decode jwt, json web token, jwt claims, jwt expiry, decode bearer token, offline jwt decoder, no upload