JWT Decoder

What is a JWT?

A JSON Web Token is a compact, URL-safe token made of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (the claims — user ID, expiry, roles, etc.), and a signature that proves the token wasn't tampered with. Anyone can decode the header and payload without a secret key — that's by design, JWTs aren't encrypted, they're signed. Never put secrets in a JWT payload.

This tool doesn't verify signatures

Decoding shows you what's inside the token. It does not verify the signature is valid, since that requires the issuer's secret or public key. Don't trust the contents of a JWT you haven't verified server-side — a decoded payload could belong to a token that's expired, revoked, or was never validly signed in the first place.

The 'alg: none' trap and expiry claims

A known class of JWT vulnerabilities involves attackers changing the header's algorithm to none and stripping the signature entirely; poorly-written verification code that doesn't explicitly check the expected algorithm can be tricked into accepting it as valid. Separately, the exp (expiry) and iat (issued-at) claims are Unix timestamps in seconds (not milliseconds) — a common bug when comparing them against JavaScript's millisecond-based Date.now() in your own verification code.