Paste a JSON Web Token to read its header and claims. The token is decoded on your device; its signature isn't checked.
0 characters · 0 lines
Result
Your result will appear here.
0 characters · 0 lines
What it does
A JSON Web Token (JWT) is three Base64URL parts joined by dots: a header, a payload of claims and a signature. This tool turns the first two back into readable JSON:
Header and payload appear together as coloured JSON, with every value exactly as written in the token.
Rows above the JSON show the algorithm (alg), the type (typ) and, when the token has them, the issued-at, not-before and expiry times as UTC dates, with whether the token has expired by your device’s clock.
The signature is never checked: the Signature row says Not checked. A token that decodes cleanly can still be forged, changed or revoked.
How to use it
Paste a token into “Your text”. A leading Bearer , as copied from an Authorization header, and spaces around the token are ignored. Select “Try a sample” to see a demo token.
The header, payload and claim rows appear next to the token and update as you type.
Select Copy to put the decoded JSON on your clipboard.
Good to know
If the token doesn’t have three parts, or a part isn’t valid Base64URL, text or a JSON object, the tool says which part is wrong.
A time claim that isn’t a number is shown as written, followed by “(not a number)”. A number too large or too small for a calendar date is shown as written, followed by “(out of range)”.
Expiry is compared with your device’s clock, so a clock that is set wrong gives a wrong answer.
The limit is 100,000 characters at a time.
Privacy
The token is processed on your device: decoding runs in your browser, nothing you paste is uploaded or saved, and the tool makes no network request. Decoding is not verifying: the tool reads the claims but can’t tell whether the token is genuine.
Frequently asked questions
Does decoding a JWT prove that it's valid?
No. Decoding only reads the header and payload, which anyone can do because they are Base64URL, not encrypted. Whether the token is genuine depends on its signature, which only a system holding the right key can check. This tool doesn't check it, so the Signature row always says Not checked.
Is it safe to paste a token here?
The token stays in your browser: this page decodes it on your device, sends it nowhere and doesn't save it. Keep in mind that a token works like a password until it expires, so whoever has a copy may be able to use it, wherever it is pasted.
What do exp, iat and nbf mean?
They are times, in seconds since 1 January 1970 UTC. iat (issued at) is when the token was made, nbf (not before) is when it starts to be accepted, and exp (expires) is when it stops being accepted. The tool shows them as UTC dates and compares exp with your device's clock to say expired or not expired.
Why can't it read my token with five parts?
A token with five parts separated by dots is an encrypted token (JWE). Its claims are encrypted, so they can't be read without the key. This tool reads signed tokens (JWS), which have three parts: header, payload and signature.
Are large numbers in claims kept exactly?
Yes. Reading JSON with JavaScript's number type rounds whole numbers above 9,007,199,254,740,991, so a long user or account ID can change by a few digits. This tool keeps every value exactly as it is written in the token.