JWT Decoder
Decode a JSON Web Token's header and payload and read its claims. No signature verification.
A JSON Web Token is three Base64url segments separated by dots: a header saying how it was signed, a payload of claims about who you are, and a signature. The part that surprises people is that the payload is not encrypted. Anyone holding the token can read every claim inside it — this page just makes that obvious.
How to use it
- Paste a JWT into the input box.
- Read the decoded Header, Payload and Signature panes.
- Check the exp claim to see when the token expires, and iss and aud to see who issued it and who it was meant for.
What to take away
Decoding is not verifying
This page shows you what a token says. It does not prove the token is genuine — that requires the signing key, which lives on the server. A system that decodes a token without verifying its signature will accept anything you hand it.
Never put secrets in a payload
Because claims are readable by anyone with the token, a JWT payload is the wrong place for anything private. If you find one carrying internal IDs, roles or personal data, that is worth writing up.
The alg field is attacker-controlled input
Historically, libraries trusted the header's alg value — so setting it to none, or swapping RS256 for HS256, could make verification pass for a token the attacker signed themselves.
Frequently asked questions
Is it safe to paste a real JWT into an online decoder?
Treat a JWT like a password — it usually is one, in the sense that holding it is enough to act as that user. Most online decoders post it to a server. This one decodes entirely in your browser and sends nothing anywhere, but the safe habit is to use expired or test tokens wherever you can.
Why can I read the payload without any key?
Because a standard JWT is signed, not encrypted. The signature proves the contents were not altered; it does nothing to hide them. If claims genuinely must stay private, the specification for that is JWE, not JWS.
How do I check whether a JWT is actually valid?
You need the issuer's signing key and must verify the signature, the expiry, and that the issuer and audience are the ones you expect. Checking expiry alone is a very common and very exploitable mistake.
Where this fits in the course
This security tool pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- JWT Forgery Lab — Tamper with a JSON Web Token — strip the signature, flip a claim, and watch a vulnerable "verify" endpoint accept it anyway.
- Base32 / Base85 Encoder — Encode or decode text in Base32 or Base85 — the less common encodings you'll still run into in CTFs.
- Encoder / Decoder — Base64, URL, and Hex — encode or decode text both ways.
- Entropy Calculator — Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.