Decode a JWT (without sending it anywhere)
Decode a JSON Web Token's header and payload and see whether it has expired. Signature is not verified; the token stays in your browser.
0 / 100,000 characters · Updates as you type.
A JSON Web Token is three Base64URL strings joined by dots: a header naming the signing algorithm, a payload of claims, and a signature. The first two parts are not encrypted, only encoded, so anyone holding a token can read them. This decoder does exactly that: it shows the header and payload as formatted JSON and turns the registered time claims (iat issued-at, nbf not-before, exp expiry) into dates, then tells you whether the token is currently expired, not yet valid, or live.
This tool does not verify the signature. Verification needs the issuer's secret or public key, which you should never paste into a web page. A decoded token with a green "not expired" flag proves only that the payload says so; it does not prove the token is genuine. Use your server-side library for that.
Tokens are sensitive: a live access token grants whatever it says it grants. This page runs the decoding in your browser and makes no network requests with the input; you can confirm that in the Network tab of your developer tools. Still, prefer expired or test tokens when you can.
How to use it
- Paste the token. A leading "Bearer " prefix is stripped automatically.
- Read the header (algorithm, type) and the payload claims in the output.
- Check the facts table: issued-at, not-before and expiry as UTC and local time, and the expired flag computed from your device clock.
- Copy the decoded JSON or download it if you need to attach it to a bug report; remove sensitive claims first.
Frequently asked questions
Why is the signature not verified?
Checking an HS256 signature needs the shared secret; checking RS256 or ES256 needs the issuer's public key. Pasting a secret into a browser tool is a bad habit, and public-key verification belongs in your backend. Decoding is safe; trusting a decoded token without verification is not.
The token says "expired" but my app still accepts it.
The expiry is computed from your device clock. If your clock is wrong, the flag is wrong. Servers also often allow a few seconds of clock skew. Compare the exp value in the facts table with the real UTC time.
What does alg "none" mean?
The token claims to be unsigned. Well-configured servers reject such tokens; the tool highlights it because "alg: none" attacks are a classic JWT vulnerability.
Can it decode an encrypted JWT (JWE)?
No. A JWE has five parts and its payload is actually encrypted. This tool handles the common signed kind (JWS) with three parts.
Is the token sent to a server?
No. Everything runs in your browser. The site has no API endpoint that receives input, and the Content Security Policy blocks connections to other origins.
Related tools
- Encode or decode Base64Encode text to Base64 or decode Base64 back to text, UTF-8 safe, with a URL-safe option.
- Format, beautify or minify JSONPretty-print or minify JSON with 2-space, 4-space or tab indentation and optional key sorting.
- Convert Unix timestamps to dates (and back)Convert a Unix timestamp to a date or a date to a timestamp; shows UTC, local time, ISO 8601 and relative time.
- Generate UUIDs (v4 or v7)Generate 1 to 100 random UUID v4 or time-ordered UUID v7 identifiers with crypto-grade randomness.
- URL-encode or decode textPercent-encode text for URLs (encodeURIComponent or encodeURI) or decode an encoded string.