How to use the JWT Decoder
- 1. Paste a test tokenUse a JWT from development or a test account, not live production.
- 2. Decode itThe token is split and read in your browser.
- 3. Read the claimsCheck the algorithm, payload and issue and expiry times.
What is inside a JWT
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are Base64URL-encoded JSON, which means anyone can read them. The signature is what proves the token was not changed.
The sample token on this page has a header of {"alg":"HS256","typ":"JWT"} and a payload with "name": "John Doe" and "iat": 1516239022. That iat value means it was issued on 18 January 2018, and the tool shows such times in IST for you.
- iat is when the token was issued.
- exp is when it expires.
- nbf is the time before which it is not valid.
- sub is usually the user ID.
Decoding is not verifying
This tool only decodes. It does not verify the signature. Seeing a neat payload does not prove a token is genuine, because anyone can create a token with any content. Your server must always verify the signature with the secret or public key.
Never paste live production tokens into any website, including this one. This page does not send your token anywhere, because decoding happens in your browser, but a live token is like a password until it expires. Use tokens from a test account or local setup, or the sample here.
Do not put secrets in a JWT payload either, since it is only encoded and not encrypted. See how that works with the Base64 decoder, read long payloads in the JSON formatter, or convert exp values with the timestamp converter.
Frequently asked questions
Does this verify the signature?
No. It only decodes the header and payload. Only your server, with the correct key, can verify that a token is genuine.
Is it safe to paste a token here?
The token stays in your browser and is not sent anywhere. Even so, never paste live production tokens into any website. Use test tokens.
Can it read encrypted tokens?
No. Encrypted tokens (JWE) have five parts and need the key. The tool will tell you when it sees one.
Is this tool free?
Yes, it is free. We ask for your name and WhatsApp number once when you see your result, and other Uncodemy tools then open without the form.