JWT Decoder
Decode and inspect JSON Web Tokens.
TOKEN CLAIMS
- ALGORITHM:
- not set
- ISSUED AT:
- not set
- NOT BEFORE:
- not set
- EXPIRES:
- not set
// What the three segments hold
- >Header — Base64URL-encoded JSON with alg, the signing algorithm, plus typ and often kid. It is the first segment of the token.
- >Payload — The claims: sub for the subject, iss for the issuer, aud for the audience, and iat, nbf and exp as Unix timestamps in seconds.
- >Signature — The third segment, produced by signing the first two with the issuer key. This page shows it as the original Base64URL string so it can be copied or compared.
// Decoding is not verification
Anyone holding a signed token can read the header and the payload, which is why a token must never carry a password, a full card number or anything else you would not put in a URL. Decoding tells you what the token claims; it tells you nothing about whether the claims are true.
Verification happens on the server that owns the key: it takes the first two segments, recomputes the signature with the shared secret or private key, and compares the bytes. A header that says "alg":"none" carries no signature at all and must be rejected.
// A token and its payload
IN
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
OUT
{ "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
The header says alg HS256 and typ JWT. The payload holds the claims, and iat is the issue time in Unix seconds.
// Questions about JWT decoding
Is a JWT encrypted?
No. A signed JWT is readable by anyone who has it; the signature proves who issued it, it does not hide anything. A token that must keep its contents secret has to be encrypted instead (JWE).
Does this page verify the signature?
No. Verification needs the secret or public key that belongs to the issuer, and pasting a production secret into a web page is a bad idea. This page reads the token; your server should verify it.
Why does my token fail to decode?
The common causes are a token that was cut short when copied, a stray line break or space inside it, or five dot-separated segments, which means an encrypted JWE rather than a signed JWT. The first segment of a JWT always begins with eyJ.
What if the payload is not JSON?
The decoded text is shown as it is. A signed payload may carry something other than JSON; only a JWT claims set is required to be JSON, and without JSON there are no claims or time rows to show.