JWT Decoder & Validator
Decode JSON Web Tokens (JWT) instantly. View header, payload, and signature. Verify token expiration and detect weak algorithms. Create test JWTs.
Encoded JWT
Header (Algorithm & Type)
No header decoded yet.
Payload (Data)
No payload decoded yet.
Signature
No signature found.
What is a JWT Decoder?
A JWT (JSON Web Token) Decoder is an essential tool for developers and security analysts to inspect the contents of a JWT. It parses the encoded Base64Url string into human-readable JSON formats, separating the token into its three core parts: the Header, Payload, and Signature. It helps verify claims, check expiration times, and spot potential security misconfigurations like the "none" algorithm.
Understanding the JWT Structure
Every standard JSON Web Token consists of three parts separated by dots (.):
1. Header
The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 (HS256) or RSA.
2. Payload (Claims)
The payload contains the claims. Claims are statements about an entity (typically, the user) and additional data. Common standard claims include iss (issuer), exp (expiration time), sub (subject), and aud (audience).
3. Signature
To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that. The signature is used to verify the message wasn't changed along the way.
Common Use Cases
- Debugging authentication and authorization flows in web and mobile applications
- Inspecting the exact Unix timestamp of a token's expiration (
expclaim) - Verifying the roles or permissions embedded inside an access token
- Security auditing to ensure tokens are using secure algorithms (e.g., preventing the "none" algorithm vulnerability)
- Generating mock tokens for unit testing API endpoints
Frequently Asked Questions
1. What is a JWT (JSON Web Token)?
A JSON Web Token (JWT) is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.
2. Is it safe to paste my JWT here?
Yes, absolutely. This tool operates 100% locally in your browser. No data, including your JWTs or its contents, is ever sent to our servers. All decoding and validation happens client-side using JavaScript.
3. Can this tool decrypt my JWT?
JWTs are typically encoded (Base64Url) and signed, not encrypted. This tool decodes the Base64Url payload to make it human-readable. If your token uses JWE (JSON Web Encryption), this tool will not be able to decrypt it without the private key.
4. Why is the 'alg: none' warning critical?
The 'none' algorithm means the token is not signed. If an API accepts tokens with the 'none' algorithm, an attacker can simply craft a malicious token, set the algorithm to 'none', and bypass authentication entirely.