Security & Crypto Tools
JWT Decoder
Decode the header and payload of a JSON Web Token.
Loading tool…
What is JWT Decoder?
A JWT decoder that splits a token into header and payload, pretty-prints the JSON, and flags expiry and insecure alg:none tokens.
How it works
The token is split on '.', base64url-decoded, and parsed; expiry is checked against the current time and insecure algorithms are flagged.
- Enter your input. Type or paste your input into the field above — the tool responds instantly.
- Review the result. Output updates live as you type. Everything runs entirely in your browser.
- Copy or download. Use the Copy button to grab the result, or Download to save it as a file.
Examples
Inspecting a token
Paste a JWT and decode its header and payload to see the alg, claims, and expiry — without verifying the signature.
Common mistakes
Decoding isn't verifying
Anyone can craft a token with any payload — decoding alone proves nothing about authenticity.
Frequently asked questions
Can it verify the signature?
No — this is a decode-only tool. Verification needs the issuer's public key and is left to the application.
Why is my payload scrambled?
The payload is base64url — the tool decodes it automatically; make sure you pasted a complete token with both dots.