jwtJWT Decoder

About the JWT Decoder

A JSON Web Token in its common form has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON objects written in base64url, the URL-safe form of Base64, and RFC 7519 defines the claims inside the payload. This tool reverses that encoding and shows the JSON. It also reads the registered claims: iss for the issuer, sub for the subject, aud for the audience, exp for the expiration time, nbf for not before, iat for issued at and jti for the token ID. Times in a JWT are in seconds since 1970, and the tool converts them to UTC dates. It tells you whether the token is inside its time window right now, using the rule that a token must not be accepted on or after its exp time and not before its nbf time. It warns about an algorithm of none, which means the token is unsigned, about a missing exp, about times that look like milliseconds, and about a malformed signature part. Two points matter more than any warning. First, decoding is not verifying: the signature is never checked here, so a decoded token proves nothing about who made it. Second, a normal JWT is encoded, not encrypted, so anyone who holds the token can read what is inside it. A token with five parts is an encrypted JWE, and its contents cannot be read without the key.