JWT decoder
Paste the token and see what is inside. Note: this decodes it, it does not verify it — checking the signature needs the key.
Your figures
Result
{
"sub": "1234567890",
"name": "Ada Lovelace",
"iat": 1700000000
}- Header
- { "alg": "HS256", "typ": "JWT" }
- Algorithm
- HS256
- Type
- JWT
- Issued at
- 2023-11-14T22:13:20Z
- Expires
- —
- Not valid before
- —
- Claims in the payload
- 3
- Signature (trimmed)
- firmaDeEjemploNo…
What we assume
- It is decoded in your browser. The token is not sent anywhere, which for a token is the bare minimum.
- The signature is not verified. That needs the key, and a key does not go into a web page. A decoded JWT is no proof that it is genuine.
- The
iat,expandnbfclaims are read as Unix seconds in UTC, which is what RFC 7519 says. - The three parts use base64url, which is not plain Base64: it uses
-and_and carries no padding. - A JWT is signed, not encrypted: anyone holding it can read the payload. Do not put anything in there you would not want seen.
How it is calculated
A JWT is three chunks separated by dots: header, payload and signature. The first two are JSON encoded in base64url, so decoding them is direct and needs no key at all. The signature is a different matter.
Decoding is not verifying
This is the confusion that costs the most. Reading a token's payload only proves what it says, not that the person who claims to have written it did. For that you recompute the signature with the secret key, and that key lives on your server: if it were here, it would stop being secret.
Signed, not encrypted
Anyone with the token can read it, including whoever intercepts it. The signature stops it being changed unnoticed, not read. That is why sensitive data does not go in the payload, however convenient it looks.
The «none» algorithm
If the header says alg: none, the token carries no signature. There was a
period when several libraries accepted that as valid, and it was a trivial way to forge
tokens. If you hit it, we warn you.
An example
The sample token carries sub, name and iat. The
1700000000 stamp becomes 14 November 2023, and the algorithm is
HS256. The signature is shown trimmed because, without the key, it tells you
nothing.
Frequently asked questions
Does it check whether the token is valid?
No, and that is deliberate. Verifying the signature needs the secret key, which should never leave your server. What we do tell you is whether it has expired according to its own exp claim.
Is it safe to paste a production token here?
The token does not leave your browser — you can confirm that in the network tab. That said, a production token is a live credential, and the healthy habit is not to paste credentials anywhere that does not need them.
Why will my token not decode?
Almost always a missing chunk when copying, or a leftover Bearer prefix. Strip it and try again.
Can I generate a JWT?
No. Signing a token requires a key, and a web tool that asks for your secret key is exactly the kind you should not use.
Keep calculating
All tools →- JSON formatter and validator Paste the JSON, pick an indent, done. If something is off we tell you exactly where, and how many keys and how deep it goes.
- JSON to YAML converter Paste the JSON and out comes the YAML. We quote the strings YAML would read as a boolean or a number, which is where nearly every surprise comes from.
- Base64 encoder and decoder Text to Base64 and back again. With real UTF-8, which is where half the home-made implementations fall over.
Updated on 2026-09-02. Calculations run in your browser; nothing you type is sent to a server.