Stays in your browser
JWT Decoder — Decode Online
Free JWT decoder. Paste a token to inspect the Base64URL header and payload. Signature is not verified.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
For debugging only. Never paste secrets into untrusted sites.
Reading a JWT without trusting it
A JWT is three Base64URL segments separated by dots: a header describing the algorithm, a payload of claims, and a signature. Decoding the first two requires no secret at all, which is exactly why you should never put anything confidential in them. Anyone who intercepts the token can read the claims; the signature only proves who issued it.
When you decode a token during debugging, the useful check is not whether it parses but whether the claims are still valid. An exp in the past means the token is expired regardless of what the API says. A mismatched aud or iss usually explains a rejection that looks mysterious in the client, and comparing the two timestamps is faster than adding logging.
Because decoding is trivial, treat a JWT like a signed document, not a locked box. This decoder runs entirely in your browser so nothing is uploaded, but the same habit applies everywhere: avoid pasting production tokens into any site you do not control, and prefer short lifetimes with refresh over long-lived tokens.
FAQ
- What is a JWT?
- A JSON Web Token used to carry identity claims for APIs.
- Do you verify the signature?
- No. This tool only decodes so you can inspect claims.
- Is my token uploaded?
- No. Decoding runs locally in your browser.
- Why can anyone read my JWT?
- Because the payload is only Base64URL-encoded, not encrypted. Signing guarantees integrity and origin, not confidentiality. Anything that must stay secret belongs in an encrypted token format or, better, in server-side storage keyed by an opaque session identifier.
- What does the exp claim mean, and what is a good value?
- exp is the expiry time as a Unix timestamp in seconds. After it passes, a compliant server must reject the token. Short lifetimes of minutes to an hour limit the damage from a stolen token; pair them with a refresh token, which is the part that needs long-term protection and rotation.
- Can I verify the signature with this tool?
- No, and deliberately so. Verification needs the signing key or public key, and a browser tool cannot keep a secret. Verify signatures on the server, where the key never leaves your infrastructure, and use this page only to read the claims.