Developer Tools

JWT Decoder and Token Inspector

Decode and inspect JWTs entirely in your browser. See the header, payload and claims, expiry times, issuer and audience, with a clear warning about signature verification.

Free, no sign-upRuns in your browserNothing uploaded

This decodes the token. It does not verify it.

A JWT payload is base64url-encoded, not encrypted, so anyone holding the token can read it - and anyone can forge a payload that reads however they like. Verifying requires the signing key, which must never be pasted into a webpage. Only the party holding that key can establish that a token is genuine.

JWT

alg: HS256JWS (signed)1 issue

Check this token

iat is in the future, which usually means the issuer clock is wrong.

Claims

iss

https://auth.example.com

sub

1234567890

aud

api

iat

1716239022

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Time claims

iat (issued at)

May 20, 2024, 9:03:42 PM

in 54 years

Expected values

The two things that most often explain a rejected token.

Issuer (iss)

Audience (aud)

Header JSON

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload JSON

{
  "iss": "https://auth.example.com",
  "sub": "1234567890",
  "aud": "api",
  "iat": 1716239022
}

Signature (43 chars of base64url) — shown because it is part of the token, but it cannot be checked here without the signing key.

A JWT is three base64url parts separated by dots: a header, a payload and a signature. The first two are encoded, not encrypted, so anyone holding the token can read its contents. This decoder splits the token and shows you exactly what is inside, which is the first thing to check when a token is rejected or when you need to confirm an issuer or audience.

It also interprets the standard time claims so you do not have to convert them yourself: exp and nbf as readable dates, iat, and the usual iss, sub, aud, jti and scope. A token that has expired, that is not yet valid, or whose audience does not match is called out immediately, because those three account for most authentication failures.

One thing to be clear about: this tool decodes, it does not verify. A JWT signature is checked with the server's secret or public key, and verifying requires that key. Anything a decoded payload claims about itself can be forged, which is exactly why the server must never trust the contents. The banner in the tool says so too, because a decoder that quietly implied verification would be worse than none.

JWT Decoder & Inspector features

Fully local decoding

Nothing is transmitted. The token is decoded in your browser with the Web Crypto API, which is also why an untrusted token cannot be used against you.

Standard claim interpretation

exp, nbf and iat as readable dates in local time and UTC, with the remaining time or the time since expiry.

Header inspection

The alg and typ values are surfaced prominently, including the none algorithm that some libraries will happily accept.

Audience and issuer checks

Set the expected issuer and audience and see whether the token matches, which is the most common cause of a rejected token.

All registered claims

iss, sub, aud, exp, nbf, iat and jti are highlighted; any custom claims are shown alongside.

An explicit verification warning

A persistent notice that this is decoding only. A forged payload decodes perfectly, and only signature verification makes a token trustworthy.

Compact and JSON output

Pretty-printed JSON for readability, plus the original compact token for copying.

How to use the JWT Decoder & Inspector

Paste the token
The whole thing, including the trailing signature, or just the header and payload sections. Whitespace and line breaks are ignored so a wrapped token from a terminal works.
Read the parts
Header and payload are pretty-printed as JSON, with alg, typ, iss, sub, aud, exp, nbf and iat highlighted where present.
Check the timings
Expiry and not-before are shown as local dates and in UTC, with how much time remains or has passed.
Look for problems
Expired tokens, tokens that are not yet valid, an audience mismatch, an unexpected algorithm and a missing signature are all flagged.

Frequently asked questions

Is it safe to paste a JWT into an online decoder?

Into this one, yes, because the decoding happens entirely in your browser and there is no network request carrying the token. That is not true of every decoder you will find, which is why pasting production tokens into random sites is a bad habit. Rotate anything you have pasted elsewhere.

Why does this not verify the signature?

Verification requires the signing key. HS256 tokens need the shared secret, RS256 and ES256 tokens need the server's public key. Neither is something you should paste into a web page. Decoding tells you what the token claims; only the party holding the key can establish that it is genuine.

What is the 'none' algorithm vulnerability?

A token with a header of {"alg":"none"} and no signature at all. Some libraries historically trusted the header's alg value, so an attacker could strip the signature and have the token accepted. Correct implementations reject it. This tool flags it, and you should never accept a token whose alg is none.

Why is my token rejected with 'invalid signature'?

The usual causes are a mismatched secret or key, a change in algorithm between signing and verification, a clock skew problem where iat is in the future, or an intermediary such as a proxy that modified the token. Check exp and nbf first, then confirm the algorithm matches what you configured.

Should I store JWTs in localStorage?

It is convenient and it is also exposed to XSS, because anything running on the page can read it. An httpOnly cookie is not readable from JavaScript and is the better default. The real fix is neither: use a short access token lifetime with refresh rotation.

Why is the payload readable when I thought it was encrypted?

JWS is signed and encoded, not encrypted. Anyone can decode it. JWE is the encrypted variant, with five base64url parts instead of three. If a payload contains anything sensitive, it belongs in a JWE or behind an encryption step, not in a JWS.

Base64 Encoder & DecoderEncode and decode Base64 for text and files, with correct UTF-8 handling.Open JSON Formatter & ValidatorFormat, minify and validate JSON with exact line and column errors.Open URL Encoder & DecoderPercent-encode, decode, build query strings and dissect any URL.Open

Every tool, in one place

ToolForge has jwt decoder & inspector plus a growing set of image, colour and developer tools. All of them run locally in your browser, free and without an account.

Browse all tools