JWT Decoder
Read what is inside a token, without sending it anywhere.
About this converter
A JWT is three base64url segments separated by dots: a header saying how it was signed, a payload of claims, and a signature. The first two are not encrypted — anyone holding the token can read them, which is worth remembering before putting anything sensitive in a payload.
This decodes both, and turns the timestamp claims into dates, since exp as 1700003600 tells you nothing and "expired 3 hours ago" tells you everything. The expiry is the reason most people open a decoder at all.
It does not verify the signature, deliberately. Verifying needs the secret or the public key, and pasting a signing secret into a website is exactly the thing nobody should ever do. A decoder that offers verification is asking for the one piece of information that must not be shared — and worse, a payload can be edited and re-encoded by anyone, so an unverified decode shows a tampered token as confidently as a real one. Check signatures in your own code, with your own key.
Because the token stays in your browser, this is safe to use with a real token from a real system. Most online decoders post it to a server first.
Frequently asked questions
Why does it not check the signature?
Because that requires the secret or public key, and no website should ever ask you for one. The signature is what makes a token trustworthy, and verifying it belongs in your own code with your own key material. Decoding tells you what a token claims; only verification tells you whether to believe it.
Is it safe to paste a real token here?
Safer than anywhere that uploads it — the decoding happens in your browser and the token is never transmitted. That said, a JWT is a live credential until it expires. Treat it like a password: close the tab when you are done, and do not paste one into a shared screen.
Is a JWT encrypted?
No. The header and payload are base64url-encoded, which is encoding, not encryption — anyone with the token can read them. The signature proves the contents have not been altered; it does not hide them. Never put anything secret in a JWT payload. (JWE, a much rarer relative, does encrypt, and is not what you have unless you know you do.)
What does "alg: none" mean?
It means the token claims to be unsigned. It is a legitimate part of the specification and also a classic attack: strip the signature, set alg to none, and a badly written verifier accepts anything. If you see it on a token that should be signed, that is worth investigating.
Does what I paste get sent anywhere?
No. The conversion runs in your browser, on your own machine — that is why the result appears as you type rather than after a wait. Nothing is uploaded, nothing is logged, and closing the tab is the end of it. This matters more here than on most pages: tokens, keys and internal data get pasted into tools like this constantly, and most of them are a form that posts to a server.