JWT Decoder

Decode JWT header, payload, and signature with expiry and algorithm warnings.

JWT177 chars

Related Tools

Base64 Encode/Decode

Encode or decode Base64 for text and files, Unicode-safe.

JSON Formatter

Beautify and pretty-print JSON with configurable indentation.

JSON Viewer

Browse JSON as a collapsible tree with search and path copy.

Documentation

What is JWT Decoder?

It splits a JSON Web Token into its header, payload, and signature, decodes the first two from base64url, and optionally verifies the signature against a secret or public key you provide.

Supported algorithms

HS256, HS384, HS512 (HMAC, shared secret) and RS256, RS384, RS512, ES256, ES384 (asymmetric, public key) via the jose library.

Best practices

Never put secrets or personal data in a JWT payload — it's readable by anyone with the token. Always check exp before trusting a token, and reject alg:none unconditionally.

Spec

RFC 7519 — JSON Web Token (JWT)

Frequently Asked Questions

What is a JWT?▾

A JSON Web Token is a compact, URL-safe way to represent claims between two parties. It has three base64url-encoded parts separated by dots: header, payload, and signature.

Can this tool read the contents of my JWT?▾

Decoding the header and payload requires no secret — they're just base64url-encoded JSON, readable by anyone who has the token. This is why JWTs should never contain sensitive data in the payload.

What does "alg:none" mean and why is it a warning?▾

It means the token claims to have no signature at all. Some libraries historically accepted alg:none as valid, which let an attacker forge tokens by simply removing the signature. Never trust an alg:none token.

How does signature verification work here?▾

For HMAC algorithms (HS256/384/512), paste the shared secret. For RSA/ECDSA algorithms (RS256/384/512, ES256/384), paste the PEM-encoded public key. The tool verifies locally using the jose library — the secret/key never leaves your browser.

Why does verification fail even though the token looks valid?▾

Either the secret/key doesn't match the one that signed the token, or the token has expired/been tampered with. The header and payload will still decode correctly even if verification fails — decoding and verifying are separate steps.

What does the expiry warning mean?▾

If the payload has an exp claim, the tool shows it as a relative time ("expires in 2h" or "expired 3d ago") so you don't have to convert the Unix timestamp yourself.

Is my token uploaded anywhere?▾

No. Decoding and verification both happen entirely in your browser.