JWT Decoder & Inspector

A JSON Web Token is three Base64url segments separated by dots: a header naming the algorithm, a payload of claims, and a signature. Debugging auth problems usually means reading the payload, which this tool decodes entirely in your browser, with expiry and issued-at times rendered as readable dates.

How to use it

1. Paste the JWT into the input box.
2. Read the decoded header and payload side by side.
3. Check the exp and iat claims, which are shown as human-readable dates.
4. Note the algorithm in the header — this tool does not verify signatures.

Frequently asked questions

Does this verify the token signature?

No. Verification requires the signing secret or public key, which should never be pasted into a web page. Decoding shows what the token claims; only your server should decide whether to trust it.

Is it safe to paste a token here?

Decoding happens entirely in your browser with no network request. That said, a live access token is a credential — prefer expired or test tokens as a matter of habit.

What do the standard claims mean?

iss is the issuer, sub the subject or user id, aud the intended audience, exp the expiry time, iat the issue time, and nbf the time before which the token is invalid. All times are Unix seconds.

What is the "alg: none" vulnerability?

A historical flaw where a server accepted a token declaring no algorithm, letting anyone forge one. Always pin the expected algorithm server-side rather than trusting the header.

All free tools · Blog · About · Contact

Also available in: Español · Português · Français · Deutsch