---
title: "JWT decoder — free, runs in your browser"
description: "Decode a JSON Web Token to read its header, payload and expiry. Free, no sign-up, and nothing you enter leaves your browser."
url: https://atoneplace.net/tools/jwt-decoder/
site: "At One Place"
---

# JWT decoder

Decode a JSON Web Token to read its header, payload and expiry.

## How it works

Splits a JWT into its three parts and decodes the header and payload, resolving the standard time claims into readable dates.

The decisive thing about a JWT is that the payload is not encrypted — it is Base64url encoded, which is not the same and provides no confidentiality at all. Anyone holding the token can read every claim in it. Putting anything sensitive in a JWT payload is a mistake that this tool demonstrates in one paste.

The signature is verified with a secret or key this page does not have, so decoding is not validation. A token can decode perfectly and still be forged, expired or issued by someone else entirely. Never trust a decoded payload without verifying the signature server-side.

The tool flags the `alg: none` header, which is a historical vulnerability class where a server accepts an unsigned token as valid.

Nothing is transmitted — the decode happens locally, so pasting a live token here does not leak it to a server. It will still be in your clipboard and browser history.

> This tool runs entirely in your browser. Nothing you enter is sent to a server, logged or stored, and the page keeps working with the network disconnected.

## Common questions

### Is a JWT encrypted?

No. The payload is Base64url encoded and readable by anyone holding the token. Never put anything sensitive in it.

### Does decoding a JWT verify it?

No. Verification needs the signing key. A token can decode cleanly and still be forged or expired.

### What is the alg:none vulnerability?

A token claiming no signature algorithm. Servers that honour it accept unsigned tokens as valid, which is a complete authentication bypass.

## Related pages

- [Word and character counter](https://atoneplace.net/tools/word-counter/)
- [Typing speed test](https://atoneplace.net/tools/typing-speed-test/)
- [Remove duplicate lines](https://atoneplace.net/tools/remove-duplicate-lines/)
- [Sort lines alphabetically](https://atoneplace.net/tools/sort-lines/)
- [JSON formatter and validator](https://atoneplace.net/tools/json-formatter/)
- [Text compare](https://atoneplace.net/tools/text-diff/)
- [Regex tester](https://atoneplace.net/tools/regex-tester/)
- [Case converter](https://atoneplace.net/tools/case-converter/)
- [Remove empty lines](https://atoneplace.net/tools/remove-empty-lines/)
- [Find and replace](https://atoneplace.net/tools/find-and-replace/)

## Sources

- Calculated on this page — At One Place (/about/)