Free tool
JWT Decoder
Paste a JSON Web Token to decode its header and payload right here in your browser. See the claims, the algorithm, and whether it has expired. Nothing leaves your machine.
Decoded entirely in your browser. Your token is never sent to a server.
Frequently asked questions
Is it safe to paste my JWT here?
This decoder runs entirely in your browser using JavaScript. Your token is never uploaded, logged, or sent to any server. That said, a JWT often grants access, so avoid pasting production tokens into any online tool you do not control, and treat this as a convenience for tokens you are comfortable exposing.
Does decoding a JWT check if it is valid?
No. Decoding only base64-decodes the header and payload so you can read them. It does not verify the signature, which is the part that proves the token was issued by your server and has not been tampered with. A token can decode perfectly and still be forged. Verification requires your secret or public key and must happen on the server.
Why can I read the payload without any key?
Because a JWT is encoded, not encrypted. The header and payload are just base64url-encoded JSON, readable by anyone who has the token. Only the signature uses a secret. This is why you must never put sensitive data like passwords in a JWT payload, and why the client cannot be trusted to validate its own token.
What do exp and iat mean?
They are standard JWT claims expressed as Unix timestamps. iat is issued-at, when the token was created, and exp is the expiry, after which the token should be rejected. This decoder converts them to readable dates and flags an expired token, but remember that only your server enforcing exp during verification actually stops an expired token from being used.
Is your app trusting tokens it should be verifying?
Decoding a token without verifying its signature is one of the most common auth mistakes in AI-generated code. Prbl scans for it, plus exposed secrets and misconfigured access control.
Run a free scan