JWT Decoder
Inspect the header, payload and signature of a JSON Web Token — locally, without sending your token to any server.
Anatomy of a JSON Web Token
A JWT is three Base64URL-encoded segments separated by dots:
eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiIxMjM0NTY3ODkwIn0 . SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c └────── Header ──────┘ └──────── Payload ────────┘ └────────── Signature ──────────┘
- Header — declares the signing algorithm (
alg) and usually the token type (typ). - Payload — the claims: statements about the subject plus standard fields such as issuer, audience and expiry.
- Signature — created over the first two segments using a secret (HS256) or a private key (RS256, ES256).
This tool decodes but does not verify. Anyone can read the header and payload of a JWT — they are encoded, not encrypted. Verifying a signature requires the secret or public key, which we never ask for and never receive. Always validate signatures in your own backend before trusting any claim.
Standard registered claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created and signed the token |
sub | Subject | The principal the token refers to, usually a user ID |
aud | Audience | Intended recipient(s) of the token |
exp | Expiration | Unix timestamp after which the token must be rejected |
nbf | Not before | Unix timestamp before which the token must be rejected |
iat | Issued at | Unix timestamp of creation |
jti | JWT ID | Unique identifier, used to prevent replay |
All registered claims use Unix timestamps in seconds since the epoch, not milliseconds. Confusing the two produces expiry dates in the distant future — a recurring bug worth checking when a token appears never to expire.
Why decode locally?
Tokens carry real session data. Pasting one into a random online decoder means it travels to someone else's server and may be logged. This decoder performs all decoding in your own browser using JavaScript. Nothing is transmitted, nothing is stored, and there is no analytics script on this page. You can confirm this by opening your browser's Network panel before decoding and watching it stay empty.
Frequently asked questions
Can you tell me whether my token is genuine?
No tool can do that without the signing key. What we can tell you is what the token claims, whether its structure is well formed, and whether it has expired according to its own exp value. Real validation always happens server-side with the key.
Why does my token show as expired even though the app works?
Check whether the developer used milliseconds instead of seconds in the timestamp. If exp has 13 digits, that is milliseconds, and some libraries tolerate it while standard ones reject it.
Can I put private data in a JWT payload?
No. The payload is Base64URL-encoded, not encrypted. Anyone holding the token can read it immediately. Keep only non-sensitive identifiers in it, and use JWE if you genuinely need encrypted tokens.
What does "alg: none" mean?
It indicates an unsigned token. This was historically abused to bypass signature checks, so every modern library rejects alg: none. If you encounter one in production traffic, investigate it.
Do you store the tokens pasted here?
No. The token exists only in your browser tab's memory and vanishes when you close it. There is no upload step and no logging layer to store it in.