JSON Web Tokens (JWTs) are everywhere in modern apps. They're the long eyJ… strings passed in Authorization: Bearer headers, stored in cookies and returned by OAuth and OpenID Connect logins. A JWT has three parts separated by dots: a header saying which algorithm signed it, a payload of "claims" such as the user ID, roles, issuer and expiry time, and a signature. The first two are just Base64URL-encoded JSON, so anyone can read them. This free JWT decoder does that instantly as you paste. It pretty-prints the header and payload with colour-coded parts, and turns the standard time claims (exp, iat and nbf) into readable dates in your time zone. It then tells you plainly whether the token is expired, not yet valid, or still live, and for how long. It also flags common red flags, like "alg": "none". One thing it deliberately does not do is verify the signature. That needs the secret or public key, which should stay on your server. So decoding a token proves nothing about whether it's genuine. Because tokens often grant access to accounts, this page decodes everything locally: nothing you paste is sent anywhere. Even so, avoid pasting live production tokens into any website you don't control.
Decode a JWT
Header
Payload
Decoding only. The signature is not verified.
How to decode a JWT
- Paste the token (with or without “Bearer ”).
- Read the header and payload.
- Check the status line for expiry.
Standard claims
| iss | Issuer |
| sub | Subject (user ID) |
| aud | Audience |
| exp / iat / nbf | Expiry / issued at / not before (Unix seconds) |
FAQ
Is decoding the same as verifying?
No. Anyone can decode a JWT. Only verifying the signature with the key proves it’s genuine and unchanged.
Are JWTs encrypted?
Standard signed JWTs (JWS) are not, so never put secrets in the payload. Encrypted JWTs (JWE) have five parts and can’t be read without the key.
Why does it say expired?
The exp claim is earlier than your device’s current time.
Is my token sent anywhere?
No. It is decoded in your browser.
Comments
Post a Comment