JWT Decoder
Decode a JSON Web Token locally to read its header, payload and claims. It does not verify the signature, so a decoded token is never reported as valid.
JWT Decoder: the tool
Token
Header
The decoded header appears here.Payload
The decoded payload appears here.How to use JWT Decoder
- Paste the token. A leading Bearer prefix, an Authorization header name, quotes and line breaks are removed for you.
- The header and payload are decoded and shown as JSON. The token is also split into its three colour-coded parts.
- The Registered claims card explains iss, sub, aud, exp, nbf, iat and jti, and turns the time claims into dates with how long ago or from now they are.
- Read the notes: they flag an unsigned token (alg none), a missing signature, claims with the wrong type and Base64 variants that strict libraries reject.
Example
A demonstration token, signed with a made-up secret. Pressing Example on the tool loads it. This is what its header and payload decode to.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsImFkbWluIjp0cnVlLCJpYXQiOjE1MTYyMzkwMjIsImV4cCI6NDEwMjQ0NDgwMH0.hEyP5RL1bCqjwvyaphQ_gR93vL8hpyKg0fyMpneMw-4
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Ada Lovelace",
"admin": true,
"iat": 1516239022,
"exp": 4102444800
}About this tool
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON encoded with Base64URL, which is an encoding and not encryption, so anyone who holds the token can read them. Never put secrets in a JWT payload.
This tool decodes the token and nothing more. It does not verify the signature, the issuer, the audience or the expiry, and it deliberately never says that a token is valid, because decoding cannot establish that. A token that says it was issued by your service, for your user, with an admin claim, may have been written by anyone. Only a server that holds the right key, a shared secret or the issuer's public key, can verify it.
The dates of exp, nbf and iat are compared with your device's clock, so they are only as accurate as that clock. Tokens with five parts are encrypted (JWE) and cannot be read without the key. The token is decoded in your browser and is not sent anywhere, but treat a live token like a password: while it has not expired, whoever holds it can use it.
Registered claims
| Claim | Name | What it says |
|---|---|---|
| iss | Issuer | Who created and signed the token |
| sub | Subject | Who the token is about, usually a user id |
| aud | Audience | Which service the token is meant for |
| exp | Expiration time | The token must not be accepted after this time |
| nbf | Not before | The token must not be accepted before this time |
| iat | Issued at | When the token was created |
| jti | JWT ID | A unique id, used to detect replays |
Frequently asked questions
Does this tool verify the token?
No. It decodes the header and payload and shows the signature as it is. Verifying needs the secret or public key and must be done by your server, using a JWT library that you configure with the algorithms you accept.
Why is a decoded token not proof of anything?
Because the header and payload are readable and writable by anyone. Without checking the signature against the right key, you cannot know who created the token or whether it was changed.
What does alg none mean?
It declares an unsigned token. Anyone can create one with any claims, so a server must never accept such a token as proof of identity. The decoder shows a prominent note when it sees it.
Is it safe to paste a production token here?
The token is decoded locally and is not uploaded. Even so, a live token works like a password until it expires, so avoid pasting it into places you do not control, prefer expired or test tokens when sharing screenshots, and revoke a token you have exposed.
How are exp, nbf and iat read?
They are NumericDate values: seconds since 1 January 1970 UTC. The tool turns them into dates and compares them with your device's clock. If that clock is wrong, the comparison is too.
Why can a five-part token not be decoded?
Five parts mean a JWE, an encrypted token. Its content is encrypted for a recipient and can only be read with the decryption key.
More developer tools
- b64Base64 DecoderDecode Base64 and Base64URL to text. Whitespace, missing padding and data URI prefixes are handled, and errors name the exact character.
- 1714Unix Timestamp ConverterConvert Unix timestamps to dates and dates to timestamps. Seconds, milliseconds, microseconds and nanoseconds are detected, and the current Unix time is always shown.
- #a1Hash GeneratorCompute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text at once, or add a key to get HMAC values. Everything runs in your browser.
- { }JSON Formatter & ValidatorFormat, validate and minify JSON. Errors point to the exact line and column, and nothing you paste leaves your browser.