Decode a JWT: Read the Header, Payload and Expiry, and Verify the Signature

A JWT looks like a long string but is really Base64-encoded JSON that anyone can read. Decoding only reads it; it does not prove the token is genuine.

Readable does not mean trustworthy

Reading the header and payload needs only Base64 decoding, no key. Only checking the signature with the correct key tells you the token has not been altered.

What the tool shows

• The header and payload in a readable form.
• exp, iat and nbf converted to dates, and whether the token has expired.
• A warning when the algorithm is none.
• Signature verification with a secret or public key for HS256, RS256 and ES256.

A caution

A live token can grant access to a system. This tool runs in your browser and does not send the token anywhere, but you should still not share a token that is still valid with other people.