JWT Decoder Converter
Read the header and claims inside a JSON Web Token.
Token
Decoded
About the JWT Decoder converter
A JWT is three Base64URL segments joined by dots: a header describing the algorithm, a payload of claims, and a signature. The first two are merely encoded, not encrypted — anyone holding the token can read them.
This decoder shows both, resolves the standard time claims into readable dates, and tells you whether the token has expired.
The claims worth checking
`exp` is the expiry and `iat` the issue time, both as Unix seconds. `nbf` marks a token that is not valid yet. `sub` identifies the subject, `iss` the issuer and `aud` the intended audience.
An `alg` of `none` in the header is a red flag: it means the token claims to need no signature at all, which is a well-known attack against naive verifiers.
Why the signature is not verified
Verifying a signature requires the signing secret or public key. Pasting a production signing secret into any website — including this one — would be a serious mistake, so the tool does not ask for one.
Decoding tells you what a token says. Only your backend, holding the key, can tell you whether it is genuine.
Handle tokens carefully
Decoding here happens entirely in your browser and nothing is transmitted. Even so, a live access token in your clipboard or terminal history is a credential. Use an expired or test token when you can, and rotate anything you have pasted somewhere you are unsure about.
Frequently asked questions
Can I edit the payload and re-sign it?
Not here. Re-signing needs the secret key, which should stay on your server.
Why does my token show as expired when it works?
The expiry is compared against your device clock. If that clock is wrong, so is the verdict.
Is a JWT encrypted?
A standard JWS token is signed, not encrypted — the payload is readable by anyone. Never put secrets in it. Encrypted tokens (JWE) are a different format and are not decoded here.