Decodificador de JWT

Pega un JSON Web Token y ve su cabecera, payload y firma, con los claims de tiempo (iat, nbf, exp) mostrados tanto en UTC como como tiempo relativo. La firma se muestra pero no se verifica — no tenemos tu clave, así que una decodificación limpia no dice nada sobre si un servidor aceptará el token.

tres segmentos base64url separados por puntos
Cómo usar este decodificador
  • Pega un JWT en el cuadro de arriba. La decodificación ocurre mientras escribes.
  • La cabecera muestra el algoritmo (alg) y el tipo de token (typ); algunos emisores también incluyen un id de clave (kid).
  • El payload lista cada claim. Los claims estándar del RFC 7519 § 4.1 (iss, sub, aud, exp, nbf, iat, jti) están marcados como tales.
  • Los claims de tiempo (iat, nbf, exp) se muestran tanto en UTC como como cadena relativa (en 12 minutos, hace 3 horas). La barra de veredicto señala tokens caducados o aún no válidos.
  • Esta herramienta no verifica la firma. Solo decodifica las partes visibles. Usa la rutina de verificación de tu servidor para confirmar un token.
  • Los tokens se procesan por completo en esta pestaña. No se sube nada.

About this tool

JWT Decoder parses and displays JSON Web Tokens (RFC 7519) without verifying the signature. It accepts tokens in the standard `header.payload.signature` form, decodes each segment from Base64URL, pretty-prints the JSON, and shows the algorithm, the key ID (if present), and the relevant claims (iss, sub, aud, exp, nbf, iat, jti). A small badge reminds you that the signature is NOT checked — verifying requires the secret or the public key, which the tool never sees.

When to use it

  • Inspecting a token from a browser's local storage or a network request during development
  • Reading the payload of an OAuth ID token to understand which claims your provider issues
  • Confirming the algorithm and key ID a token was signed with before debugging an auth integration
  • Decoding a token you generated for a test fixture

When not to use it

  • You need to verify the signature — this tool only decodes. For verification, use a library in your application code with the secret or public key
  • You need to decode encrypted JWTs (JWE) — JWE is a different spec with a different envelope. This tool handles JWS (signed, not encrypted) only
  • You are pasting real production tokens — paste test tokens only, even though the page is local

Frequently asked questions

Does it check the signature?

No. The tool only decodes. It does not know your secret or your public key, and it never will — that would be a security antipattern. For verification, use a JWT library in your code (jsonwebtoken, jose, pyjwt) with the right key.

What is the difference between JWS and JWE?

JWS (JSON Web Signature) is signed and the payload is readable by anyone with the token — this is the common case for OAuth ID tokens. JWE (JSON Web Encryption) encrypts the payload so only the holder of the decryption key can read it. This decoder handles JWS only.

Why is the algorithm shown as 'none'?

The 'none' algorithm is a real but dangerous JWT algorithm that means "not signed". If you see it in a token from a third party, that is a bug in their library — flag it. Never accept tokens with alg=none in production.

← Back to the homepage · More guides · More from the blog