Friendly Toolkit
JWT Decoder
Decode a JWT
Decode a JSON Web Token's header and claims, and check when it expires.
Free, private, no sign-up
Was this tool helpful?
Suggest an improvementDecode a JSON Web Token
Paste a JWT (with or without Bearer ) to see its header and payload as formatted JSON. Registered
claims such as exp, iat and sub are named, times are shown as dates, and
the status tells you whether the token has expired.
Decoding is not verifying
Anyone can create a token that decodes. This tool doesn't check the signature, so never trust a token's contents just because it decodes here. Your server must verify it with the right key.
Good to know
Is it safe to paste a real token?
The token stays in this browser tab and is never sent anywhere. Even so, treat live tokens like passwords.
Why is "alg: none" flagged?
A token with no signature algorithm can be forged by anyone. Servers should reject it.
Can it decode encrypted tokens (JWE)?
No. A JWE has five parts and an encrypted payload. Only signed tokens (JWS, three parts) can be read without the key.