JWT
JWT Decoder
Decode a JWT's header and payload, check its expiry status and verify its signature.
Header
Payload
Not verified
Algorithm
This token's algorithm is none which means it is unsigned. Issuing or accepting a token like this in production is a known security vulnerability.
This tool runs entirely in your browser; the token is never sent to a server. Signature verification requires a secure connection (HTTPS) or running on localhost.
ABOUT
Decode a JWT and check its signature and expiry
A JWT has three dot-separated parts: header, payload and signature. The first two are plain Base64URL that anyone can read — the security of a token rests on its signature. This tool shows header and payload, explains standard claims such as exp, iat and iss in plain language, and verifies the signature with an HMAC secret or a PEM public key. The token never leaves your browser.
HOW TO
How to use it
- Paste the token.
- Header, payload and expiry status appear immediately.
- To verify, enter the HMAC secret (HS256) or a PEM public key (RS256/ES256).
FAQ
What does
Frequently asked questions
Is a JWT encrypted?
No. A standard JWT is only signed and its contents are readable — never put secrets in the payload.
What does alg: none mean?
The token carries no signature. Accepting one on a server is a well-known vulnerability and such tokens must be rejected.
Does this tool store my token?
No. Everything runs in your browser and nothing is sent to a server.