JWT decoder
Decode a JSON Web Token's header and payload without sending it anywhere.
Have feedback or an idea for this tool?
What is a JWT?
A JSON Web Token, or JWT, is a compact, signed token used to carry identity and claims between a client and a server, typically after login. It has three parts separated by dots: a header naming the signing algorithm, a payload holding claims such as the subject, issuer and expiry, and a signature that lets the server verify the token was not tampered with. This tool decodes the header and payload so you can read the claims in plain text, entirely in your browser, without sending the token anywhere. Paste a token to inspect it. Remember that decoding is not verification: the payload is only Base64-encoded, not encrypted, so never place secrets in it. Use the decoder to debug an authentication flow, to check a token expiry and claims, or to confirm which algorithm and issuer a service uses.
Key facts
- A JWT is a compact string of three Base64url parts joined by dots: header, payload and signature.
- A JWT header and payload are Base64url encoded, not encrypted, so anyone holding the token can read them without a key.
- Decoding a JWT is not the same as verifying it, because only checking the signature with the signing key proves the token is authentic.
- RFC 7519 registered claims include iss, sub, aud, exp, iat, nbf and jti, where exp, iat and nbf are Unix timestamps in seconds.
- HS256 is symmetric HMAC-SHA256 using one shared secret, while RS256 is asymmetric RSA-SHA256 where a private key signs and the public key verifies.
What a JWT actually is
A JSON Web Token (JWT) is a compact, URL-safe string made of three parts joined by dots: header.payload.signature. The header and payload are JSON objects that are Base64url encoded (not encrypted), and the signature is a keyed hash or digital signature over the first two parts.
Because the header and payload are only encoded, anyone who holds the token can decode and read them without any key. Decoding just reverses that Base64url step and pretty-prints the JSON. This tool does exactly that, in your browser - nothing is uploaded to a server.
Standard claims you will see
The payload carries claims - name/value pairs describing the token. The RFC 7519 registered claims are: iss (issuer), sub (subject, usually the user id), aud (audience the token is intended for), exp (expiry as a Unix timestamp), iat (issued-at), nbf (not-before), and jti (a unique token id). All time claims are seconds since the Unix epoch, so exp of 1735689600 is a date, not a duration.
Everything else is a custom claim your app defined - roles, tenant id, email, scopes. Remember the payload is world-readable, so never put passwords, API keys, or other secrets in it.
Algorithms: HS256 vs RS256
The header's alg field names the signing algorithm. HS256 is HMAC with SHA-256 - a symmetric scheme where the same secret both signs and verifies, so every service that verifies must hold the shared secret. RS256 is RSA with SHA-256 - asymmetric, so a private key signs and only the matching public key is needed to verify, which is safer for tokens verified by many parties (for example via a JWKS endpoint).
Watch the alg: none pitfall. A token can claim alg: none to declare it is unsigned. A correctly configured verifier must reject none (and reject a token whose alg does not match what you expect), otherwise an attacker can strip the signature and forge claims. Decoding a token here shows you its alg but does not act on it.
Decoding is not verifying
This is the point that trips people up: reading a token's contents proves nothing about its authenticity. A decoded token is not a validated token. The signature is what proves it was issued by a trusted party and not tampered with, and checking the signature requires the signing key (the HMAC secret or the RSA/EC public key) plus checks on exp, nbf, iss and aud.
So never trust an unverified token. Verification belongs on your server or gateway using a maintained library - jsonwebtoken or jose in Node, PyJWT in Python, golang-jwt in Go - never by eyeballing the payload. Use this decoder to inspect and debug what a token contains, not to decide whether to trust it.
Glossary
- JWT (JSON Web Token)
- A JWT is a compact, URL-safe string made of three Base64url parts joined by dots: header, payload and signature. It carries claims about a subject and is defined by RFC 7519.
- Header
- The header is the first JWT segment, a Base64url-encoded JSON object naming the token type and the signing algorithm in its alg field, such as HS256 or RS256.
- Payload
- The payload is the middle JWT segment holding the claims as a Base64url-encoded JSON object. It is encoded, not encrypted, so anyone holding the token can read it - never place secrets there.
- Signature
- The signature is the third JWT segment, a keyed hash or digital signature over the header and payload. Checking it with the signing key is what proves the token is authentic and untampered.
- Registered claims (iss, sub, exp)
- Registered claims are the standard fields RFC 7519 defines, including iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued-at) and nbf (not-before). The time claims are Unix timestamps in seconds.
- HS256 vs RS256
- HS256 is symmetric HMAC-SHA256, where one shared secret both signs and verifies. RS256 is asymmetric RSA-SHA256, where a private key signs and the matching public key verifies, suiting tokens checked by many parties.
Questions, answered.
Is my token sent to a server?+
No. The token is decoded entirely in your browser using JavaScript, so even a real, live JWT never leaves your machine. That makes it safe to paste tokens here.
Should I paste a production token into an online JWT decoder?+
Only into a decoder that runs fully in your browser, like this one. A JWT is a live credential, so pasting it into a tool that sends it to a server means handing your credential to that server. As a habit, never paste secret-bearing production tokens into online tools whose behaviour you cannot see; prefer an in-browser or CLI decoder.
Does this verify the signature?+
No. Decoding shows what the token contains, but it does not check that the signature is valid. Verification needs the signing key (the HMAC secret or the public key) and checks on exp, iss and aud, and it should happen on your server, not in a browser tool.
Why can I read the payload without a key?+
A JWT's header and payload are only Base64url encoded, not encrypted, so anyone holding the token can decode and read them. The signature is what proves the token was not tampered with. Because the payload is readable by anyone, never put passwords or secrets in it.
What is the difference between HS256 and RS256?+
HS256 is symmetric HMAC-SHA256: one shared secret both signs and verifies, so every verifier must hold that secret. RS256 is asymmetric RSA-SHA256: a private key signs and only the public key is needed to verify, which suits tokens verified by many services, often via a JWKS endpoint.
What does 'alg: none' mean and why is it dangerous?+
'alg: none' declares that a token is unsigned. If a verifier accepts it, an attacker can remove the signature and forge any claims they like. A correct verifier must reject 'none' and reject any token whose algorithm does not match what the application expects.
How do I read the exp and iat claims?+
exp (expiry) and iat (issued-at) are Unix timestamps - seconds since 1 Jan 1970 UTC. Convert the number to a date to check whether the token is expired. nbf (not-before) works the same way and marks the earliest time the token is valid.
Can I decode a JWT from the command line?+
Yes. A JWT is three Base64url parts split by dots, so you can decode the payload with a one-liner, for example: echo TOKEN | cut -d. -f2 | base64 -d. On many systems you may need to pad the string or use base64url decoding; a small script or a library like jose or PyJWT is more reliable for automation.
Cloud that speaks India.
These tools run on ServerCake infrastructure in India. When our cloud opens, you get VMs and managed databases priced in ₹, billed with GST, on India-resident infrastructure. Reserve your spot for early access.
Reserve your spot