JWT decoder
Decode JSON Web Tokens in your browser. Header, payload, and signature — without sending the token to any server.
Frequently asked questions
What is a JWT?
A JSON Web Token (JWT) is a compact, signed token that carries claims between two parties. It has three parts separated by dots: header (algorithm and type), payload (the claims, e.g. user and expiry) and signature (proof it was not tampered with). It is widely used for authentication and APIs.
Is it safe to paste my JWT here?
Yes. This tool decodes the token 100% in your browser — we don't send anything to any server, we keep no history, and we use no cookies. Even so, avoid pasting production tokens into any website; use test tokens or redact sensitive claims first.
Does it verify the signature?
No. Verifying the signature requires the secret key (HS256) or the public key (RS256/ES256/EdDSA), which we don't have. This tool only decodes the parts — perfect for inspecting claims, debugging expiries, and reviewing what info the token carries.
What do exp, iat, and nbf mean?
They are standard claims from RFC 7519: "exp" (expiration time) is when the token stops being valid; "iat" (issued at) is when it was issued; "nbf" (not before) is when it starts being valid. All three are Unix timestamps in seconds.
What is the "none" algorithm and why is it dangerous?
It means the token is unsigned. Anyone can modify it without detection. If your backend accepts tokens with alg "none", it is a serious vulnerability — historically it has allowed full authentication bypass. Always reject alg "none" on the server side.