🎫 JWT Decoder

header · claims table · exp/iat made human · no signature lie

Advertisement

A JWT is not encrypted — it is three base64url segments holding plain JSON, which is why this page can read yours and why nothing secret belongs in one. Paste a token and get the header (algorithm), every claim, and expiry/issued dates converted to your calendar. The signature cannot be checked here because you do not have the issuer's key — anyone who tells you a JWT is "verified" from the token alone is selling something.


Paste a token to see its header and claims. Nothing is sent to a server — decoding happens in this page.

What a token is, and what it is not

header.payload.signature — each segment base64url, the signature made with a key only the issuer holds. Anyone can read; only the issuer can make read-proof. That is why the honest design of a JWT decoder is this page: entirely local, explicitly non-verifying, and loud about expiry, because "the token decoded fine" has ended more security investigations than any bug. For debugging signature failures you need the library that verifies with the real key, not a website.

Part of Everyday Tools. Like everything on tukuk.org: free, no account, no tracking.

Advertisement
Advertisement