JWT DECODER

By -

JWT Decoder

Paste a JSON Web Token to inspect its header and payload — decoded entirely in your browser, never sent anywhere.

Token

Header

    

    

      
Payload

      

    

  


  

  

    This only decodes the token to show what it contains — it does not verify the signature, since that requires the secret key or public key that only the issuing server holds. A token can be decoded and read by anyone; that's normal and by design for JWTs, which is why sensitive data shouldn't be stored in the payload.
  












How this tool works


A JSON Web Token has three parts separated by periods: a header (describing the signing algorithm and token type), a payload (the actual claims — data like a user ID, an issue time, and an expiration time), and a signature (used by the server to verify the token hasn't been tampered with). The header and payload are encoded with Base64URL, not encrypted — meaning anyone can decode and read them, which is normal and expected for JWTs.


This tool splits the token on those periods, decodes the header and payload segments from Base64URL back into readable JSON, and — if an exp (expiration) claim is present — converts that Unix timestamp into a human-readable date and tells you whether the token is still valid.



Frequently asked questions



Can this tool verify if a token is legitimate (not forged)?

No, and this is an important distinction — verifying the signature requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms), which only the issuing server holds. This tool only decodes and displays what's inside the token.



Why can I read the payload without any password?

Because JWTs aren't encrypted — they're signed. The signature proves the token wasn't altered since it was issued, but it doesn't hide the contents. This is exactly why sensitive information (passwords, secrets, personal data beyond a basic user ID) should never be stored in a JWT payload.



What does "iat" mean in the payload?

"iat" stands for "issued at" — a Unix timestamp marking when the token was created, distinct from "exp" (expiration).



Is my token sent to a server when I paste it here?

No. The decoding happens entirely in your browser using standard Base64 decoding — the token never leaves your device, which matters since tokens can sometimes grant real account access.





 








































Comments











Post a Comment