JWT decoder
Decode a JSON Web Token and inspect its header, payload and expiry — everything runs locally in your browser.
JWT Decoder
This free online JWT decoder splits a JSON Web Token into its header, payload and signature and shows the decoded JSON. It also reads the standard time claims, tells you whether the token has expired, and can verify HMAC signatures. Everything runs in your browser, so the token is not uploaded to a server.
What is a JWT?
A JSON Web Token is a compact, URL-safe way to pass claims between
parties. It has three Base64URL parts separated by dots:
header.payload.signature. The header names the signing
algorithm, the payload holds the claims, and the signature lets a
server check the token was not changed.
How to decode a JWT
- Paste the token into the Encoded token box.
- The header and payload are decoded automatically.
- Check the Claims table for expiry and issue times.
- To check the signature, enter the secret and click Verify.
Common JWT claims
- iss — who issued the token.
- sub — the subject, usually a user ID.
- aud — who the token is intended for.
- exp — expiry time (Unix seconds).
- nbf — not valid before this time.
- iat — when the token was issued.
- jti — a unique token ID.
Is a JWT encrypted?
No. A standard signed JWT is encoded, not encrypted. Anyone who has the token can read the header and payload, so never put passwords or other secrets in it. The signature only proves the contents were not altered.
Why does the algorithm "none" matter?
A token with "alg": "none" has no signature. Servers
must reject such tokens and only accept the algorithms they expect.
This tool flags it with a warning.