JWT decoder
Decode a JSON Web Token to read its header, payload and expiry.
How it works
Splits a JWT into its three parts and decodes the header and payload, resolving the standard time claims into readable dates.
The decisive thing about a JWT is that the payload is not encrypted — it is Base64url encoded, which is not the same and provides no confidentiality at all. Anyone holding the token can read every claim in it. Putting anything sensitive in a JWT payload is a mistake that this tool demonstrates in one paste.
The signature is verified with a secret or key this page does not have, so decoding is not validation. A token can decode perfectly and still be forged, expired or issued by someone else entirely. Never trust a decoded payload without verifying the signature server-side.
The tool flags the `alg: none` header, which is a historical vulnerability class where a server accepts an unsigned token as valid.
Nothing is transmitted — the decode happens locally, so pasting a live token here does not leak it to a server. It will still be in your clipboard and browser history.
This tool runs entirely in your browser. Nothing you enter is sent to a server, logged or stored, and the page keeps working with the network disconnected.
Common questions
- Is a JWT encrypted?
- No. The payload is Base64url encoded and readable by anyone holding the token. Never put anything sensitive in it.
- Does decoding a JWT verify it?
- No. Verification needs the signing key. A token can decode cleanly and still be forged or expired.
- What is the alg:none vulnerability?
- A token claiming no signature algorithm. Servers that honour it accept unsigned tokens as valid, which is a complete authentication bypass.
Related pages
- Word and character counter Words, characters, sentences, paragraphs and reading time, counted as you type.
- Typing speed test Measure words per minute and accuracy on a one, two or five minute test.
- Remove duplicate lines Strip repeated lines from a list, keeping the first occurrence of each.
- Sort lines alphabetically Sort a list of lines A–Z, Z–A, by length, or numerically.
- JSON formatter and validator Pretty-print, minify and validate JSON, with the exact position of any error.
- Text compare Compare two blocks of text and see which lines were added, removed or changed.
- Regex tester Test a regular expression against sample text, with matches and capture groups shown.
- Case converter Convert text between upper, lower, title, sentence, camel, snake, kebab and other cases.
- Remove empty lines Delete blank lines from a block of text, optionally collapsing runs to one.
- Find and replace Replace every occurrence of a string in pasted text, with optional regex.
Sources
- Calculated on this page — At One Place