Free › JWT Decoder
Free live tool
JWT Decoder.
Paste a token. See what is inside, and what is wrong with it.
Runs in your browser. Nothing you paste is uploaded or stored.
Decoder
Read any JSON Web Token.
Header, payload, dates in plain time, and a check for common problems.
Decoding is not verifying. Anyone can read a token. Only the key can prove it is genuine.
What you are looking at
Three parts, joined by dots.
Header
How it is signed.
Names the algorithm, such as HS256 or RS256. If it says "none", the token carries no signature at all.
Payload
The claims.
Who the token is for, who issued it and when it expires. It is only encoded, not encrypted, so never put secrets in it.
Signature
The proof.
Created with a secret or private key. A server must check it on every request. Reading the payload proves nothing.
Trusting what the payload says.An attacker can edit the payload in seconds. Only a verified signature makes the claims believable.
Accepting alg "none".Some old libraries accepted unsigned tokens. Always fix the expected algorithm on the server.
No expiry.A token without exp lives forever if stolen. Short lifetimes limit the damage.
More free tools.
Lessons, tools and datasheets. No sign-up.