JWT decoder
Split a JWT and decode Header / Payload (no signature check)
Paste a three-part token and decode its header and payload. This page does not verify signatures or establish that a login credential is valid.
Example
Input
eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0.
Example result
Header: {"alg":"none"}
Payload: {"sub":"demo"}This unsigned teaching example must not be used for authentication.
Technical details & limits
Compact JWS joins Base64URL header, payload and signature segments with dots. NumericDate claims such as exp use seconds. Decoding and browser-clock checks do not replace server validation of signatures, allowed algorithms, iss, aud, nbf and exp. Five-part JWE is not supported.
About this tool
Decode the header and payload of a three-part JWT locally and display readable JSON. Inspect fields such as alg, sub and exp. The tool does not verify signatures or authorize access.
Use cases
- Debug an auth flow by seeing what the client actually received.
- Check whether a token’s exp has already passed.
- Paste an example JWT decoding into documentation.
How to use
- Paste the JWT (aaa.bbb.ccc) into the input.
- Click Decode to display the header and payload. Valid JSON is formatted automatically.
Notes
Signature verification is not implemented here. Production systems need trusted verification keys, an allowed algorithm and complete claim checks.
FAQ
- Does successful JWT decoding mean the signature is valid?
- Successful JWT decoding means the content can be parsed, not that its signature is valid. This tool handles the common 3-part JWS structure and does not support 5-part JWE tokens. Authentication requires server-side verification of the signature, algorithm, issuer, audience, and relevant time claims. Treat displayed payload fields as untrusted input until those checks succeed, even when the token looks well formed and its dates appear reasonable.
- Is the JWT exp expiration claim measured in seconds or milliseconds?
- The JWT exp claim uses NumericDate seconds rather than milliseconds. Multiply a seconds value by 1000 to obtain the millisecond representation commonly used by JavaScript dates; recent values often have 10 and 13 digits respectively. Check the source definition instead of relying solely on digit length. Final token validity depends on server-side verification and the allowed clock tolerance, not just the date displayed by this browser tool.
- Why can a five-part JWE token not be decoded like a three-part JWT?
- A 3-part JWS and a 5-part JWE have different structures, and this tool only decodes the header and payload of the former. A JWE contains encrypted content that requires suitable algorithms and keys. Removing segments does not turn it into an ordinary signed token. Use software that supports the original token format, and preserve its exact structure when passing it to an authorized verification or decryption process.
Related tools
Base64 encode / decode
JSON formatter