JWT Decoder
Decode is not verify. A readable payload is not a trusted user.
Decode is not verify. A readable payload is not a trusted user. alg: none, an expired exp, and a token you found in a log will all “decode” just fine.
Paste the token. You get header and payload as JSON. Nothing here checks the signature. If you needed that, you needed your server and the real secret, not this page.
How to use it
- Read
algfirst.nonemeans there is no signature.HS256vsRS256is not a style choice. If the header saysnoneand you still trust the claims, that’s the bug. exp,nbf, andiatare Unix seconds, not milliseconds. Aexpin 2020 still decodes. It is just dead.- Three segments: header, payload, signature. Two segments is usually
alg: noneor a truncated copy-paste.
When it breaks
- An invalid Base64url character (a
+from standard Base64, a trailing newline) fails the decode. Trim it. - This will not tell you if the token is authentic. Anyone can mint a payload.
- Don’t paste live production tokens. The claims are the data. Treat them that way.
JWT Token
Paste your JWT to decode
About JWTs
- • Header contains the algorithm and token type
- • Payload contains the claims (user data, expiration, etc.)
- • Signature is used to verify the token wasn't tampered with
- • JWTs are Base64URL encoded (not encrypted!) — anyone can read the contents
Features
- Splits header.payload.signature and Base64URL-decodes the first two parts
- Does not verify the signature. A decoded token is not a trusted token
- Flags alg none and other unsigned-looking headers
- Turns exp, iat, and nbf Unix seconds into readable dates
- Pretty-prints claims so nested JSON is readable
Common Use Cases
- See which alg and kid a staging token actually carries
- Confirm a 401 is an expired exp, not a parse failure
- Teach that anyone with the token can read the payload
- Inspect a fixture JWT before wiring a real verifier
Decode is not verify
Decode is not verify. A readable payload is not a trusted user. alg: none, an expired exp, and a token you found in a log will all “decode” just fine.
Paste the token. You get header and payload as JSON. Nothing here checks the signature. If you needed that, you needed your server and the real secret, not this page.
Read alg first. none means there is no signature. HS256 vs RS256 is not a style choice. If the header says none and you still trust the claims, that’s the bug. exp, nbf, and iat are Unix seconds, not milliseconds. A exp in 2020 still decodes. It is just dead.
Three segments: header, payload, signature. Two segments is usually alg: none or a truncated copy-paste.
Examples
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyX2Zha2VfMDEiLCJuYW1lIjoiVGVzdCBVc2VyIiwiZXhwIjoxOTE2MjM5MDIyLCJpc3MiOiJodHRwczovL2F1dGgudGVzdC5leGFtcGxlIn0.signature-not-verifiedeyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhdHRhY2tlciIsInJvbGUiOiJhZG1pbiJ9.eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyX2Zha2VfMDEifQFrequently Asked Questions
Decode is not verify. A readable payload is not a trusted user. alg: none, an expired exp, and a token you found in a log will all “decode” just fine. Paste the token. You get header and payload as JSON. Nothing here checks the signature. If you needed that, you needed your server and the real secret, not this page.
Read alg first. none means there is no signature. HS256 vs RS256 is not a style choice. If the header says none and you still trust the claims, that’s the bug. Three segments: header, payload, signature. Two segments is usually alg: none or a truncated copy-paste.
exp, nbf, and iat are Unix seconds, not milliseconds. A exp in 2020 still decodes. It is just dead.
An invalid Base64url character (a + from standard Base64, a trailing newline) fails the decode. Trim it. This will not tell you if the token is authentic. Anyone can mint a payload. Don’t paste live production tokens. The claims are the data. Treat them that way.
Tips
- If the payload looks empty, you probably pasted two segments instead of three.
- A token that decodes can still be expired, wrong-aud, or signed with a leaked HS256 secret.
- Never put real production tokens in docs, issue templates, or this page's sample field.