Decode a JSON Web Token to inspect its header and payload, with registered claims explained and timestamps converted to dates. Decoding never verifies the signature.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
How to use the JWT Decoder
- Paste the token. A leading "Bearer " prefix is removed automatically.
- Choose whether to show the header, the payload or both.
- Keep the explain option on to see registered claims described and timestamps converted to readable dates.
- Click "Decode JWT".
Frequently asked questions
Does decoding a JWT verify that it is genuine?
No, and this is the single most important thing to understand about JWTs. The header and payload are only Base64URL-encoded, not encrypted or protected. Anyone can decode them, alter them and re-encode them. Only checking the signature with the correct key proves the token is authentic, and that check belongs on your server.
Is it safe to paste a real token here?
The decoding happens entirely in your browser and nothing is transmitted, logged or sent to analytics. That said, a live token is a credential: anyone who obtains it can act as you until it expires. Treat it with the same care as a password and prefer expired or test tokens.
What do sub, iss, aud, exp, nbf and iat mean?
They are registered claims from RFC 7519: subject (who the token is about), issuer (who created it), audience (who should accept it), expiry, not-before and issued-at. The three time values are Unix timestamps in seconds, which the tool converts to dates for you.
Why is the signature section unreadable?
Because it is raw bytes – the output of an HMAC or a digital signature algorithm – not text. It is Base64URL-encoded for transport but has no meaningful text form.
The header says alg is none. What does that mean?
That the token carries no signature at all. Any system that accepts such a token can be trivially impersonated; it is a well-known vulnerability class. A production verifier must reject alg none outright rather than treating it as a valid algorithm.
