JWT Decoder
Paste a token to read its header and claims. Expiry is checked against your clock; the signature is not verified.
—
—
—
Worked example
Decoding is not verification. Anyone can craft a token with any claims they like; only the signature tells you the issuer actually produced it. Reading claims from an unverified token and trusting them is how "admin: true" becomes an incident.
A JWT is three base64url segments separated by dots: header, payload, signature. The first two are plain text in disguise — base64 is an encoding, not a lock. This tool shows them and stops there, because verification needs the issuer's key and that belongs in your server code, not in a random web page.
Reading the claims
exp is expiry in Unix seconds, iat is issuance, nbf is not-before. iss and aud identify who issued the token and who it was meant for — a token with the right signature but the wrong audience is still an invalid token, and skipping that check is a real vulnerability class.
The traps this page flags
A token with alg: none and no signature is the oldest JWT attack: the server is told not to verify. A token with no exp never expires, which means a leaked one is valid forever. Both are visible in the header and payload, and both are worth catching before the token reaches production.
Where to verify
Signature verification requires the key: HMAC for symmetric, the issuer's public key for RS256/ES256. Do it on the server, check iss, aud and exp after the signature, and reject any algorithm the issuer did not publish — accepting whatever the header claims is the algorithm-confusion vulnerability.