JWT Decoder / Inspector
Paste a JWT to decode its header and payload and check for risks like alg:none, expiry, or a missing exp. Everything runs in your browser; signatures are not verified.
Everything runs in your browser. Your input is never sent to a server.
Paste a JWT above to see the decoded output.
How to use
- 1
Paste the JWT you want to inspect (header.payload.signature — three parts).
- 2
The header and payload are decoded and risky values are listed.
- 3
exp / iat / nbf are shown as human-readable timestamps.
Why it matters
The key thing to understand: a JWT is not encrypted. Anyone can Base64URL-decode and read it. So never put secrets in the payload, reject alg:none, and always set exp — those are the basic defenses.
FAQ
QIs my JWT sent anywhere?
A
No. Decoding happens entirely in your browser; the token is never sent to a server. Still, be careful handling production secrets.
QIs the signature verified?
A
No. This tool only decodes and inspects the contents (verification needs the key; for defense the point is to see what's inside).