JWT Decoder

Paste a JSON Web Token and see its header, payload, and signature, with the time-based claims (iat, nbf, exp) shown as both UTC and relative time. The signature is displayed but not verified — we don't have your key, so a clean decode says nothing about whether a server will accept the token.

three dot-separated base64url segments
How to use this decoder
  • Paste a JWT into the box above. Decoding happens as you type.
  • The header shows the algorithm (alg) and the token type (typ); some issuers also include a key id (kid).
  • The payload lists every claim. Standard claims from RFC 7519 § 4.1 (iss, sub, aud, exp, nbf, iat, jti) are marked as such.
  • Time claims (iat, nbf, exp) are shown as both UTC and a relative string (in 12 minutes, 3 hours ago). The verdict bar flags expired or not-yet-valid tokens.
  • This tool does not verify the signature. It only decodes the visible parts. Use your server's verification routine to confirm a token.
  • Tokens are processed entirely in this tab. Nothing is uploaded.

About this tool

JWT Decoder parses and displays JSON Web Tokens (RFC 7519) without verifying the signature. It accepts tokens in the standard `header.payload.signature` form, decodes each segment from Base64URL, pretty-prints the JSON, and shows the algorithm, the key ID (if present), and the relevant claims (iss, sub, aud, exp, nbf, iat, jti). A small badge reminds you that the signature is NOT checked — verifying requires the secret or the public key, which the tool never sees.

When to use it

  • Inspecting a token from a browser's local storage or a network request during development
  • Reading the payload of an OAuth ID token to understand which claims your provider issues
  • Confirming the algorithm and key ID a token was signed with before debugging an auth integration
  • Decoding a token you generated for a test fixture

When not to use it

  • You need to verify the signature — this tool only decodes. For verification, use a library in your application code with the secret or public key
  • You need to decode encrypted JWTs (JWE) — JWE is a different spec with a different envelope. This tool handles JWS (signed, not encrypted) only
  • You are pasting real production tokens — paste test tokens only, even though the page is local

Frequently asked questions

Does it check the signature?

No. The tool only decodes. It does not know your secret or your public key, and it never will — that would be a security antipattern. For verification, use a JWT library in your code (jsonwebtoken, jose, pyjwt) with the right key.

What is the difference between JWS and JWE?

JWS (JSON Web Signature) is signed and the payload is readable by anyone with the token — this is the common case for OAuth ID tokens. JWE (JSON Web Encryption) encrypts the payload so only the holder of the decryption key can read it. This decoder handles JWS only.

Why is the algorithm shown as 'none'?

The 'none' algorithm is a real but dangerous JWT algorithm that means "not signed". If you see it in a token from a third party, that is a bug in their library — flag it. Never accept tokens with alg=none in production.

← Back to the homepage · More guides · More from the blog