JWT Decoder - Read Claims, Expiry Status, and Algorithm

A JSON Web Token packs a small amount of signed JSON into a compact string, and it is used everywhere in modern authentication because a server can trust a valid token without looking anything up in a database. It has three parts joined by dots: a header naming the signing algorithm and token type, a payload of claims about the user and the token, and a signature over the first two. The header and payload are only base64url-encoded, so decoding them is trivial, which is exactly what this tool does.

The line worth being honest about is the signature. A decoder can read the claims, but it cannot tell you whether they are trustworthy, because that requires the key the token was signed with, and only the servers involved hold it. That is not a limitation of this particular tool; it is true of every browser-based decoder, and any that claims to verify a signature without a key is not telling the truth. So this tool shows the signature segment plainly and states that it is unverified, rather than implying a check it cannot perform.

One header value deserves special attention. The algorithm field tells a server how the token was signed, and a value of none means it was not signed at all. A classic attack takes a legitimate token, rewrites its algorithm to none, and deletes the signature, betting that a carelessly written server will skip verification and accept it. Because this is subtle and dangerous, the tool flags an alg: none token in red the moment it decodes one. A correct implementation rejects none outright and accepts only a fixed set of strong algorithms it expects.

This connects to the single most important habit when working with JWTs: decoding is not verifying. Everything this tool shows you comes from an unverified token, which is to say from data an attacker could have written. It is perfect for understanding a token’s structure, debugging why a login failed, or confirming which claims a service issues, but the values only become trustworthy once a server has checked the signature against the right key and validated the issuer, audience, and expiry. Read here; trust only after verifying there.

And a note on confidentiality: a signed JWT is not encrypted. The payload is readable by anyone who has the token, so it must never carry secrets. Everything here happens in your browser with no network request, which keeps your token private from us, but the token’s own claims are visible to every party it passes through, and that is a property of JWTs, not of this tool.

Each JWT segment is base64url, so the Base64 Converter can decode an individual part by hand, and the JSON Formatter will pretty-print and validate the resulting claims. The signature is built on hashing, which the Hash Generator can compute for the SHA algorithms JWTs use.