JWT Decoder
Decode a JSON Web Token’s header and payload, with expiry and standard claims resolved to readable dates. The token never leaves your browser — which matters, because a JWT is usually a live credential and most online decoders post it to a server.
This decodes; it does not verify. Checking a signature needs the secret or public key, and pasting a signing secret into a web page is a habit worth not having. See below.
How it works
What the three parts are
A JWT is three Base64url-encoded segments separated by dots: header.payload.signature.
- The header names the signing algorithm, for example
HS256. - The payload holds the claims — who the token is about, when it expires, and whatever else the issuer added.
- The signature is computed over the first two parts with a secret or private key.
The first two parts are encoded, not encrypted. Anyone holding the token can read them, exactly as this page does.
Never put secrets in a payload
This follows directly from the point above, and it is the most common JWT mistake. Because the payload is readable by anyone with the token, it must not contain passwords, API keys, personal data you would not hand to the bearer, or internal identifiers you would rather not disclose. The signature guarantees the payload has not been altered; it does nothing to hide it.
Standard claims, and the alg:none attack
Registered claims: iss issuer, sub subject, aud audience, exp expiry, nbf not-before, iat issued-at, jti token ID. The time claims are Unix timestamps in seconds, and this tool resolves them to dates and flags an expired token.
A classic vulnerability: a token presented with its algorithm set to none and an empty signature. A verifier that trusts the header’s declared algorithm accepts it as valid. Always verify against an algorithm your server chose, never the one the token asks for. This decoder flags that case when it sees it.
What people use it for
- Checking why a token is rejected — usually an expiry that has passed or a wrong audience.
- Reading the claims an identity provider actually issued.
- Confirming a scope or role made it into the token.
- Debugging a clock-skew problem with
nbforiat. - Inspecting a token from a log without pasting a live credential into someone else’s website.
Nothing is uploaded. This tool runs entirely in JavaScript in your browser. Your input is never sent to a server, never logged and never stored, and no account is required. Once the page has loaded you can go offline and it still works — open your browser's network tab and watch if you'd like to confirm it.
Frequently asked questions
Does this verify the signature?
No, deliberately. Verification requires the signing secret or public key, and pasting a signing secret into a web page is a bad habit regardless of who runs the page. Verify on your server, using a library and an algorithm the server chose.
Is it safe to paste a real token here?
Safer than any decoder that posts it to a server: decoding happens entirely in your browser and the token is never transmitted. Still treat a live token as a credential. If it has leaked somewhere you do not control, rotate it.
Can I put sensitive data in a JWT payload?
No. The payload is Base64url-encoded, not encrypted, so anyone holding the token can read it. The signature prevents modification, not disclosure.
What is the alg:none attack?
A token presented with its algorithm set to none and an empty signature. A verifier that trusts the header's declared algorithm will accept it as valid. Always verify with an algorithm fixed on the server side.
Why is my token expired when it looks recent?
The exp claim is a Unix timestamp in seconds, not milliseconds. A millisecond value is read as a date far in the future. Check the resolved dates shown above.
Tools that run where your code is
This page does its work in your browser because sending your data to a server to process it is a bad default. Catalase applies the same idea to AI coding: a free, open-source code editor that runs language models on your own machine through Ollama, with no account and no telemetry. Cloud models are there when you choose one, not by default.
Related tools
- Base64 encode / decode — Decode any Base64url segment by hand.
- Epoch converter — Resolve exp and iat timestamps.
- Hash generator — SHA-256 and SHA-1 digests.