Does this verify the signature?

No. It decodes the header and payload and ignores the signature segment entirely, so an expired, forged, or tampered token decodes exactly like a valid one. Proving authenticity requires checking the signature against the issuer’s secret (HS256) or public key (RS256/ES256) with a JWT library — something no decoder can do for you.

How can it decode my token without the secret?

Because the header and payload are only base64url-encoded JSON — an encoding, not encryption. The secret is needed to create or verify the signature, never to read the contents. The practical consequence: anything you put in a JWT payload is readable by whoever holds the token, so never store secrets in claims.

What are exp, iat and nbf?

Registered time claims, expressed as NumericDate values: seconds since the Unix epoch. For example iat 1516239022 is 2018-01-18T01:30:22Z. A classic bug is generating them in milliseconds — the token then appears to expire tens of thousands of years from now, or before 1971, depending on the check.

Why does it say "Not a valid JWT"?

The input must contain at least two dot-separated base64url sections that decode to JSON. Truncated copy-pastes, stray characters, or line breaks inside the token are the usual causes. Encrypted JWE tokens (five segments) also fail, because their payload is ciphertext rather than readable JSON.

Can I decode a token that has no signature part?

Yes — only the first two segments are read, so header.payload with nothing after the second dot still decodes. That is a feature for debugging, and a reminder of the core point: whether a token decodes says nothing about whether it should be trusted.

Is it safe to paste a production token here?

The token never leaves your browser: decoding is a local string transformation with no network request, and nothing is stored. But a live token is still a bearer credential — anyone who obtains it can call your API until it expires — so prefer expired or staging tokens for debugging, and rotate any production token that has been shared or pasted around carelessly.

JWT Decoder

Decode a JSON Web Token to inspect its header and payload. Decoding only — no verification, all in your browser.

Runs in your browser — files never leave your device

JWT

This decodes the token only — it does not verify the signature.

How it works

A JSON Web Token is three base64url-encoded segments joined by dots: header.payload.signature. This tool splits the token on the dots, base64url-decodes the first two segments, parses each as JSON, and pretty-prints the header and payload side by side — live, as you paste. The signature segment is never read.

Paste the well-known example token from JWT tutorials and the header decodes to {"alg":"HS256","typ":"JWT"} while the payload shows {"sub":"1234567890","name":"John Doe","iat":1516239022}. Time claims are NumericDate values — seconds since the Unix epoch — so that iat is 2018-01-18T01:30:22Z; read exp and nbf the same way when chasing expiry bugs.

Decoding is not validating. Base64url is an encoding, not encryption: anyone holding a token can read everything in it, and this tool performs zero verification. Change a character in the payload, or delete the signature segment entirely, and the token still decodes without complaint. Only verifying the signature — with the issuer’s secret for HS256, or its public key for RS256/ES256 — proves a token is authentic and untampered, so never make a trust or authorization decision from decoded output alone.

Within that limit, a decoder is the fastest auth-debugging tool there is. Check whether exp is already in the past (or was issued in milliseconds instead of seconds), whether iss and aud match what the API expects, whether a scope or role claim is missing, and which alg and kid the header names when key rotation breaks verification.

Everything happens in your browser — no request is made, and refreshing the page discards the token. Even so, treat live production tokens as the credentials they are: a bearer token grants access to whoever holds it until expiry. Debug with expired or staging tokens when you can.

Frequently asked questions

Does this verify the signature?: No. It decodes the header and payload and ignores the signature segment entirely, so an expired, forged, or tampered token decodes exactly like a valid one. Proving authenticity requires checking the signature against the issuer’s secret (HS256) or public key (RS256/ES256) with a JWT library — something no decoder can do for you.
How can it decode my token without the secret?: Because the header and payload are only base64url-encoded JSON — an encoding, not encryption. The secret is needed to create or verify the signature, never to read the contents. The practical consequence: anything you put in a JWT payload is readable by whoever holds the token, so never store secrets in claims.
What are exp, iat and nbf?: Registered time claims, expressed as NumericDate values: seconds since the Unix epoch. For example iat 1516239022 is 2018-01-18T01:30:22Z. A classic bug is generating them in milliseconds — the token then appears to expire tens of thousands of years from now, or before 1971, depending on the check.
Why does it say "Not a valid JWT"?: The input must contain at least two dot-separated base64url sections that decode to JSON. Truncated copy-pastes, stray characters, or line breaks inside the token are the usual causes. Encrypted JWE tokens (five segments) also fail, because their payload is ciphertext rather than readable JSON.
Can I decode a token that has no signature part?: Yes — only the first two segments are read, so header.payload with nothing after the second dot still decodes. That is a feature for debugging, and a reminder of the core point: whether a token decodes says nothing about whether it should be trusted.
Is it safe to paste a production token here?: The token never leaves your browser: decoding is a local string transformation with no network request, and nothing is stored. But a live token is still a bearer credential — anyone who obtains it can call your API until it expires — so prefer expired or staging tokens for debugging, and rotate any production token that has been shared or pasted around carelessly.

JWT Decoder

How it works

Frequently asked questions

Related tools