How to decode a JWT
- Paste the token into the box. A leading
Beareris removed automatically. - The header and payload are decoded instantly and shown as formatted JSON.
- Cards summarise the algorithm, issuer, subject and audience, and turn
exp,iatandnbftimestamps into readable dates with a clear expired or valid status. - To check the token is genuine, enter the shared secret (for HS256, HS384, HS512) or the issuer's public key in PEM format (for RS, PS and ES algorithms) and press Verify.
What is inside a JWT?
A JSON Web Token has three Base64url-encoded parts separated by dots: a header naming the signing algorithm, a payload of claims about the user or session, and a signature. The header and payload are only encoded, not encrypted, which is why anyone can read them. The signature is what stops tampering: the server recomputes it with its key and rejects the token if it does not match.
Standard claims include exp (expiry), iat (issued at), nbf (not valid before), iss (issuer), sub (subject, usually a user ID) and aud (intended audience). Times are in seconds since the Unix epoch.
Is it safe to paste tokens here?
Yes. Decoding and signature checks use your browser's built-in Web Crypto API, and nothing is sent to a server. Still, treat live tokens as passwords: anyone holding an unexpired token can usually act as that user, so avoid sharing them in chats or tickets.
Can a JWT be decoded without the secret?
Yes. The header and payload are just Base64url-encoded JSON. The secret is only needed to create or verify the signature, never to read the claims.
Why does verification fail with the right secret?
Check whether the secret is stored as Base64 (tick "Secret is Base64"), whether there is trailing whitespace, and that the algorithm in the header matches the one your server uses.
What does "alg: none" mean?
The token claims to be unsigned. Servers must reject such tokens, as accepting them lets anyone forge claims. It is a well-known JWT vulnerability.
Which key format does RS256 verification need?
A public key in SPKI PEM format, starting with "-----BEGIN PUBLIC KEY-----". If you only have a JWKS or certificate, convert it to a PEM public key first.