Overview
A JSON Web Token looks like three blocks of gibberish separated by dots — but it is not encrypted gibberish, just encoded JSON. The first block is the header (algorithm and type), the second is the payload (claims like user id and expiry), and the third is the signature that proves it has not been tampered with. This decoder opens the first two instantly.
Paste a token and read its claims: who it is for, when it was issued, when it expires, and any custom data the issuer embedded. An expiry check tells you at a glance whether the token is still alive.
What is actually inside a JWT?
Three base64url-encoded parts. The header names the signing algorithm (usually HS256 or RS256) and the token type. The payload carries claims — registered ones like iss (issuer), sub (subject), exp (expiry) and iat (issued-at), plus whatever custom claims the application added. The signature is the header and payload, hashed with the issuer's secret: it proves authenticity without hiding anything.
The critical insight: base64url is encoding, not encryption. Anyone with the token can decode and read the payload — which is exactly what this tool does. That is by design; secrecy was never the payload's job. Never put passwords or secrets in claims.
Features
- Instant decode of header and payload as pretty-printed JSON.
- Expiry check — expired tokens flagged, remaining life shown.
- Claim timestamps rendered as readable UTC dates.
- alg=none warning for unsigned tokens.
- Honest signature display: shown, never “verified” — verification needs your secret.
- Private: decoding is local; tokens never leave the page.
Benefits
- Debug auth fast. See exactly what your login returned.
- Spot expiry bugs. One glance tells you if the token is dead.
- Learn the format. The three parts, colour-coded and explained.
- Safe habit: the tool teaches why secrets do not belong in payloads.
Who can use it
Developers debugging authentication flows, API integrators inspecting tokens from OAuth providers, QA engineers testing expiry handling, security students learning how JWTs work, and anyone who copied a long token from a network tab and wondered what it says. Backend developers verifying their own token issuance will find the claim view indispensable.
How to use
- Paste the JWT into the input box (header.payload.signature).
- Read the decoded header: algorithm and token type.
- Read the decoded payload: claims, expiry and custom data.
- Check the status line for expiry and warnings.
- Never paste a production secret or private key anywhere — decoding needs neither.
Frequently asked questions
Is a JWT encrypted?
No — standard JWTs are only base64url-encoded, which anyone can reverse (this tool proves it). The signature guarantees the token has not been altered, but it does not hide the contents. If payload secrecy is required, that is what JWE (JSON Web Encryption) is for — a different, genuinely encrypted format.
Why can't this tool verify the signature?
Verification needs the secret key (HS256) or public key (RS256) the issuer used — and you should never paste secrets into a website, ours included. Decoding answers “what does it say?”; verification answers “do I trust it?” and belongs in your backend code.
What does alg=none mean?
An unsigned token — anyone can forge one. Some libraries historically accepted alg=none if the attacker asked, a famous vulnerability class. The decoder flags it loudly: never trust an unsigned token in production.
My token has 5 parts, not 3 — what is it?
Probably a JWE (encrypted JWT), which has five parts: header, encrypted key, IV, ciphertext, auth tag. This decoder handles only signed JWTs (JWS compact serialisation); encrypted tokens cannot be read without the decryption key, which is the point.
Is pasting a token here safe?
Decoding is fully local — the token never leaves your browser. Still, treat tokens like passwords: prefer decoding test tokens, and revoke any production token you paste anywhere outside your own systems.
Conclusion
Three dots, three parts, zero mystery. Paste the token, read the claims, respect the signature — and never hide secrets where everyone can read them.