ToolAtlas
FavoritesRecent

JWT decoder

Processed in this browser

Text limit: 2000000 characters

This tool never uploads your input.

Inspect only. Signatures are not verified. JWT is not encryption. Treat alg:none as hostile.

Read the header and payload of a JSON Web Token in this tab. Anyone who has the token can do the same — JWT is not encryption. We do not verify the signature, so a forged token can still ‘decode’ cleanly.

You have a Bearer token and an auth bug: is it expired, which alg, what is in sub? That is this page. The fear people type is “is it safe to decode a JWT online?” — because a JWT is often a live credential.

Decoding is Base64URL plus JSON. It is not decryption. jwt.io is the brand everyone knows; many clone sites are not jwt.io. This decoder stays in the tab and does not verify the signature.

How a JWT is put together

A compact JWS has three segments: header.payload.signature. The first two are readable to anyone who intercepts the token. The signature is what an API should check with a pinned key — work we do not do here.

  1. Paste the token. Do not mail it to a teammate’s “random decoder.”
  2. Read alg, kid, iss, aud, exp.
  3. Open DevTools → Network if you want proof the paste did not leave.

If you only needed to decode a blob that is not a JWT, use Base64.

What this will not do

  • Verify HS256/RS256/ES256 or show a green “signature verified” badge.
  • Decrypt JWE.
  • Forge admin tokens or recover a secret.
  • Replace a proper JWT library test suite.

alg: none is a red flag, not a feature. Algorithm confusion (HS vs RS) is a server bug; a decoder can only show you the header.

Treat refresh tokens and session JWTs like passwords. Expired test tokens are the ones that belong on a webpage debugger.

FAQ

Is it safe to paste a production JWT here?

Decoding does not need a server. Confirm with the Network panel that no request fires when the claims appear. For a long-lived admin token, the safest habit is still atob in your own DevTools or an air-gapped machine.

Does this verify HS256 or RS256?

No. We only decode. A valid-looking payload says nothing about whether your API would accept the signature. We also will not crack a secret.

Is a JWT encrypted?

Typical JWS tokens are signed and Base64URL-encoded, not encrypted. Claims such as email or user id are readable. JWE (encrypted JWT) is a different format we do not decrypt.

Why do people warn about alg none?

A header of alg: none means no signature. Old verifiers that trusted the token’s own algorithm could accept a forged token. Pin algorithms on the server. Seeing none here is a lint, not a fix.

Can I encode or resign a token?

No. This page is inspect-only. For raw Base64URL experiments use the Base64 tool — that still is not JWT signing.

What about exp, iat, and nbf?

Those claims are Unix times in the payload. We show the JSON; treat expiry as a debug hint, not proof the token is revoked.

Related tools