JWT Decoder

Paste a JSON Web Token into the input panel. A leading Bearer prefix is stripped automatically, so you can paste an Authorization header straight from your network tab.

The Claims panel summarises the registered claims: signing algorithm, issuer, subject, audience, and the validity window built from the iat, nbf and exp claims. An expired token is flagged in red.

The three panels underneath show the decoded header, the decoded payload, and the raw signature segment, each with its own copy button.

Decoding is done locally in your browser. The signature is not verified, because verification requires the issuer's secret or public key — something you should never paste into a web page.

Is it safe to paste a JWT here?

Decoding happens entirely in your browser — the token is never sent over the network, logged or stored. That said, a JWT is a live credential until it expires, so treat any token you paste anywhere with the same care as a password and prefer expired or test tokens when you can.

Does this tool verify the signature?

No, and that is deliberate. Verifying requires the signing secret or public key, which belongs on your server and should never be pasted into a web page. This tool answers what is in the token; your backend must still answer whether the token is authentic.

Why can anyone read my token's contents?

A standard JWT is signed, not encrypted. The header and payload are merely Base64URL-encoded, so anyone holding the token can read every claim in it. Never put passwords, secrets or sensitive personal data in a JWT payload — use JWE if the contents genuinely must be confidential.

What do iat, nbf and exp mean?

They are registered time claims, each a Unix timestamp in seconds. iat is when the token was issued, nbf is the earliest time it may be accepted, and exp is when it stops being valid. Verifiers typically allow a small clock-skew tolerance of a minute or two around nbf and exp.

Why does a token with alg set to none show an error?

The none algorithm means the token is unsigned, so anyone can forge one by editing the payload. It exists in the specification but is a well-known attack vector, and any library that accepts it in production is misconfigured. This tool flags it so you notice.