JWT
Decode a JWT online
Look at the token header and payload without sending it to a server. The signature is not verified.
What this JWT decoder can do
- Header and payload decoded as JSON
- Standard claims explained (iss, exp, iat, nbf)
- alg: none security warning
- Token length and algorithm summary
- Sample token for a quick look
- Signature segment shown, never sent anywhere
How to decode a JWT online
Paste the token
Insert the full JWT with its two dots — or load the sample.
Read the header
See the algorithm and the token type.
Inspect the payload
Claims are listed with human-readable timestamps.
Check the warnings
alg: none tokens and anomalies are highlighted.
Frequently asked questions
Is the signature verified?
No — decoding only reads the payload. Verification needs the secret or public key, which this tool deliberately doesn't ask for.
Is it safe to paste a real token?
Decoding happens entirely in your browser; the token is never uploaded. Still, treat tokens like passwords on shared machines.
What do exp, iat and nbf mean?
exp — expiration time, iat — issued at, nbf — not valid before. All are Unix timestamps in seconds.
What does alg: none mean?
A token without a signature. Any service accepting it is insecure — the tool highlights this case.