JWT Decoder

Decodes a JSON Web Token's header and payload without needing the signing secret, showing the claims inside — issuer, subject, expiration, and any custom claims — in readable JSON. A JWT's payload is base64-encoded, not encrypted, so anyone holding the token can already read its contents. Useful for debugging an authentication flow where a token isn't accepted — checking the exp claim against the current time is the single most common cause of a rejected token. This tool decodes only; it does not verify a token's signature.

Older JWT libraries had a well-known vulnerability around the alg: "none" header value, where a token could be accepted with no signature check at all — modern libraries reject this by default, but it's worth confirming for a custom or older implementation.

📖 Read more in our Knowledge Base →