JWT decoder
Paste a token and read what is actually inside it: every claim, what the registered ones mean, when it expires, and how many bytes it costs you on every single request.
Runs in your browser. The token is never uploaded.
Decoded in your browser. Nothing is sent anywhere, which is not true of every tool that does this.
01 / Header
- alg
- HS256
- typ
- JWT
02 / Payload
- sub
- user_42Subject. Who the token is about, usually a user id.
- name
- Ana Ríos
- role
- admin
- iat
- 17672256001/1/2026, 12:00:00 AMIssued at. When it was minted.
- exp
- 17672292001/1/2026, 1:00:00 AMExpiry. After this the token must be rejected.
- iss
- https://auth.example.comIssuer. Who minted this token.
03 / Signature
not_a_real_signature
Not verified, and deliberately so. Checking it needs the signing secret, and pasting your signing secret into a web page is a worse problem than an unverified token. Anyone can read a JWT. Only the holder of the key can trust one.
The single most important thing about a JWT is the thing its appearance hides: the payload is not encrypted. It is base64url, which is encoding, not encryption. Anyone holding the token can read every claim in it, which this page demonstrates by doing exactly that without any key. Never put anything in a token you would not put in a URL.
What the signature buys you is integrity, not secrecy. It proves the claims were not altered after the issuer signed them, provided you actually verify it, provided you check the algorithm is the one you expected, and provided you reject alg: none outright. Every serious JWT vulnerability of the last decade has been a failure of one of those three.
Watch the size. A token travels on every authenticated request, so a fat one with a permissions array in it is bandwidth you pay for forever and a cookie limit you will eventually hit. The usual fix is to put an identifier in the token and look the rest up.
Questions people arrive with
- Is it safe to decode a JWT online?
- Usually not, and that is the reason this one exists. Most online decoders send your token to a server, and a JWT is a live credential until it expires. This decoder runs entirely in your browser: nothing is uploaded, nothing is logged, and you can confirm it by opening the network tab and watching nothing happen.
- How do I read what is inside a JWT?
- The header and payload are base64url encoded JSON, so they are readable by anyone holding the token. Only the signature needs a key, and it proves the token was not altered rather than hiding anything. Paste one above and every claim is decoded with expiry, algorithm, and what each standard claim means.
- Why can't I log a user out immediately with a JWT?
- Because verifying a JWT is checking a signature, not looking anything up, which is exactly what makes it fast and stateless. Nothing is asked whether the token is still allowed, so it stays valid until it expires unless you keep a denylist, and keeping one gives back the state you chose a JWT to avoid.