JWT decoder
Reads a JSON Web Token and points out risky settings, such as no signature algorithm, no expiry or secrets in the payload. It doesn't check the signature, because that needs the server's key.
Nothing you type leaves this page
How it works
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The first two are only Base64url-encoded, not encrypted, so anyone holding the token can read them. This decoder shows both and turns the date claims (exp, iat, nbf) into readable times.
It also flags settings that often lead to vulnerabilities: the “none” algorithm, missing expiry, very long lifetimes, keys named in the header, and secrets or personal data in the payload.
Questions people ask
Is it safe to paste a token here?
The token is decoded only in your browser and never sent anywhere. Still, treat live tokens like passwords and prefer test tokens.
Why doesn't it verify the signature?
Checking the signature needs the server's secret or public key. Without it no tool can tell whether a token is genuine.
Are JWTs encrypted?
Normal signed JWTs (JWS) are not. Only JWE tokens are encrypted, and for those only the header can be read.
More free tools
Found a bug or want another tool? Contact