Can this tool modify a JWT?
No. This is a read-only decoder. To modify a JWT, you would need the original signing key to generate a new valid signature.
JWT Decoder
Developer Utility
JWT Decoder
Decode a JWT's Base64URL header and payload in your browser. Signature verification is not performed; signed-in use may save tokens to account history.
{}{}JSON Web Tokens (JWT) are a standard for securely transmitting information between parties as a JSON object. Use this utility to inspect decoded claims while debugging. It does not authenticate users or verify token signatures.
The tool decodes the Base64Url-encoded header and payload. Decoding does not verify the signature, issuer, audience, or expiry and must not be treated as authentication. When signed in, submitted tokens and decoded output are sent to account history. Avoid production credentials.
How to Use This Tool
- Paste your encoded JWT into the input field.
- Select Decode to inspect the decoded Header and Payload JSON.
- Read claims such as `exp` as data only; the tool does not check whether they are valid.
- Never paste a production token. When signed in, successful decoding may save the token and decoded output to account history.
The Three Parts of a JWT
A JWT typically consists of three parts separated by dots (.): the Header, the Payload, and the Signature. The Header usually specifies the signing algorithm (like HS256 or RS256). The Payload contains the 'claims', which are statements about an entity (typically, the user) and additional data.
The Signature is the most critical part for security, as it allows the receiver to verify that the sender is who they say they are and that the message wasn't changed along the way. Note: This tool decodes the content but does not verify the signature locally.
Standard Claims You Should Know
JWTs often include 'Registered Claims' which are recommended but not mandatory. Common ones include iss (issuer), sub (subject), aud (audience), exp (expiration time), and iat (issued at).
Decoding a token and checking these claims is the first step when a user reports being logged out prematurely or having incorrect permissions. You can verify if the token has expired or if it was issued for the correct audience (your application).
Security Warning: Don't Trust Decoded Data Alone
Because JWTs are only Base64Url encoded (not encrypted), anyone who intercepts a token can read its contents. You should NEVER store sensitive information like passwords or private keys in a JWT payload.
Furthermore, while our decoder shows you the content of the token, your application MUST verify the signature against a secret key or public certificate before trusting any of the information in the payload. Failing to verify the signature makes your application vulnerable to token tampering.
Frequently Asked Questions
What is the difference between JWS and JWE?
JWS (JSON Web Signature) tokens are signed but their payload is visible. JWE (JSON Web Encryption) tokens have an encrypted payload that is not readable without a decryption key.
How do I check if a JWT is expired?
Look for the 'exp' claim in the payload. It is a Unix timestamp. If the current time is greater than this value, the token is expired.
Related Developer Tools
These tools are commonly used alongside this one.