JWT decoder
Paste a JSON Web Token and read its header and payload. Decoding happens in your browser, so a production token is not sent anywhere, which is the part that matters when the token you are debugging is real.
Runs in your browser — nothing is uploadedWhat a JWT actually is
Three base64url segments joined by dots: header, payload, signature. The first two are encoded, not encrypted. Anyone holding the token can read every claim in it, which is why a JWT must never carry anything you would not put in a URL.
Decoding is not verifying
This tool decodes. It does not check the signature, and neither should anything that only needs
to display a claim. But a service that trusts a claim must verify the signature against the expected key
and algorithm, and must reject alg: none outright. Reading the payload and acting on it without
verification is the single most common JWT vulnerability.
Claims worth checking
exp and nbf are Unix timestamps in seconds, not milliseconds,
which is a frequent source of tokens that appear to expire in 1970 or in the year 55000. iat is
issued-at, aud the intended audience, and iss the issuer. A verifier that checks the
signature but not aud will happily accept a valid token minted for a different service.
Questions
Is it safe to decode a JWT online?
Only if the decoding happens locally. This one runs entirely in your browser: the token is never sent to a server, never logged and never leaves the page. Pasting a production token into a tool that posts it somewhere is handing over a live credential.
Can I verify the signature here?
No, and that is deliberate. Verifying needs the signing key, and sending your signing key to a web page is worse than sending the token. Verify in your own code with a library that pins the expected algorithm.
Why does my exp claim show 1970?
The value is in seconds and something is reading it as milliseconds, or the reverse. A JWT exp near 1.7 billion is seconds; near 1.7 trillion means someone wrote milliseconds into a field the spec says is seconds.
What is the alg: none attack?
A token with its algorithm set to none and the signature removed. A verifier that reads the algorithm out of the token itself, rather than pinning what it expects, will treat it as valid. Always pin the algorithm.