JWT Decoder
Paste a JSON Web Token to read its header and payload, see when it was issued and when it expires, and spot risky settings. Decoding happens in your browser — but treat real tokens like passwords and avoid pasting live production tokens into any website.
Decoding is not verifying
Anyone can read a JWT's header and payload because they are only Base64URL-encoded. What makes a token trustworthy is its signature, which your server must verify with the correct key and an allow-list of algorithms. This tool does not verify signatures — it helps you inspect claims such as sub, aud, iat and exp.
Frequently asked questions
Is it safe to paste a JWT here?
The token is decoded only in your browser. Still, a valid token can grant access to an account, so prefer test or expired tokens and never share live ones.
Why is alg:none dangerous?
It means the token is unsigned. A server that accepts it lets anyone forge tokens. Servers should reject 'none' and only accept the algorithms they expect.
Can I put secrets in a JWT payload?
No. The payload is readable by anyone who has the token. Store only identifiers and claims, not passwords or personal data.
More free security tools
Advertisement