JWT Decoder

Decode a JSON Web Token into readable header and payload JSON, entirely in your browser.

Security ToolsRuns in your browserFree, no sign-up

JWT

Decoded token

Output appears here as you type.

Ctrl + Enter to run

About the JWT Decoder

A JWT is three Base64url-encoded segments separated by dots: a header, a payload of claims, and a signature. Decoding shows the first two, because they were never secret — anyone holding the token can read them, which is worth remembering before you put anything sensitive in a claim.

Decoding is not verification. It shows what a token claims; only checking the signature against the issuer's key proves the token was not forged or altered, and that needs a key you should never paste into a web page. Decode here to inspect claims and expiry, verify in your backend.

Frequently asked questions

Is it safe to paste a JWT here?

Safer than on most sites, because decoding happens entirely in your browser — no request is made and nothing is logged. That said, a JWT is a live credential: the safest habit is to only paste tokens from a development environment, or to revoke a production token after inspecting it. You can verify the no-network claim in your devtools Network tab.

Why is the signature not verified?

Verification requires the signing key, and a tool that asks you to paste your HMAC secret or private key is a tool you should not use. Decoding tells you what a token claims; only your server, holding the key, can tell you whether those claims are authentic.

Is a JWT encrypted?

No — a standard JWS token is signed, not encrypted. The header and payload are plain Base64url, readable by anyone who has the token. Never put a password, API key or unnecessary personal data in a JWT payload. (JWE is a separate, genuinely encrypted format that is rarely used in practice.)

What does the "alg: none" algorithm mean?

It means the token is unsigned, and it is a historically serious vulnerability: several libraries once accepted alg:none tokens as valid, letting an attacker forge any claims. Any token you see with alg:none should be treated as untrusted, and your verifier should reject it explicitly rather than relying on defaults.