JWT Decoder
Paste a JSON Web Token and read its header, its payload and its standard claims, with an expired or not-yet-valid warning where the token carries one.
Token
Syntax colouring is off for this document because recolouring something this large on every keystroke would slow typing down. Every tool still works normally.
This decodes the token. It does not verify the signature. A token can be perfectly well formed and completely forged at the same time; only checking it against the actual key it was signed with can tell the difference, and this page never asks for one.
Header
Syntax colouring is off for this document because recolouring something this large on every keystroke would slow typing down. Every tool still works normally.
Decoded JSON appears here.
Claims
Decoded claims appear here.
Payload
Syntax colouring is off for this document because recolouring something this large on every keystroke would slow typing down. Every tool still works normally.
Decoded JSON appears here.
Signature
Shown exactly as written. This is cryptographic output, not text, so there is nothing to decode it into.
Runs entirely in your browser. Nothing you paste is uploaded, and you can confirm that in your browser Network tab.
About this tool
A JSON Web Token is three base64url encoded parts joined by dots, a header, a payload and a signature. The header and payload are themselves JSON once decoded, so this page decodes each with the same base64url decoder the JSON to Base64 tool already uses, URL safe alphabet and missing padding both handled, and reports which of the two failed if either does not decode cleanly or does not turn out to be a JSON object. The signature is shown exactly as written and never decoded further, since it is cryptographic output rather than text and there is nothing readable inside it to show. Seven registered claims from the payload get their own row when the token carries them: issuer, subject, audience, issued-at, not-before, expiry and a JWT ID, with the three time based ones read as the dates they actually are rather than left as raw numbers. A token whose expiry has passed, or whose not-before time has not arrived yet, is marked as such plainly rather than left for you to work out from the raw numbers yourself. What this page does not do, on purpose, is check the signature against anything: doing that honestly needs the actual secret or public key the token was signed with, which this page never asks for, and a decoder that implied trust it could not back up would be worse than one that says nothing. A token can be perfectly well formed, decode cleanly here, and still be forged or altered, and only real signature verification, a separate tool, can tell the difference.
How to use
- Paste a JSON Web Token. It is the three dot separated parts most APIs hand you as a single string.
- The header, the payload and the standard claims decode as you type. Nothing here is sent anywhere; it all happens in your browser.
- Check the Claims panel for an expired or not-yet-valid warning, and remember: this decodes the token, it does not verify it.