JWT decoder
Frequently asked questions
Everything you need to know about JSON Web Tokens
What is a JSON Web Token (JWT)?
A JWT is an open standard (RFC 7519) for transmitting information compactly and securely between parties as a JSON object. It consists of three dot-separated parts: header, payload and signature, each base64url encoded. It is mainly used for authentication and information exchange.
Does this tool verify the token signature?
No. The tool only decodes the header and payload to show their content in clear text. It does not verify the cryptographic signature, since that would require the secret or public key. Decoding happens entirely in your browser: no token is sent to a server.
Is the content of a JWT secure/secret?
No, the payload of a standard JWT is only base64url encoded, not encrypted: anyone can read it. Never put sensitive data in the payload. The signature only guarantees that the token has not been tampered with, not that its content is secret. For confidentiality you need encryption (JWE).
Does the JWT decoder verify the signature?
No, the decoder only reads the header and the payload, and does not check the signature. Deciding whether a token is genuine takes the secret key, which stays on the server that issued it.
How do I tell whether a JWT has expired?
When the payload carries the exp field, the value is turned into a readable date and time, and the token is marked expired or valid against your computer clock. The iat field appears as a date too.
Is the token I paste sent anywhere?
No, the decoding happens in the browser: the token is split on the dots and the first two base64url parts are turned into JSON locally, with no call to any server.