JWT Decoder
Decode and inspect JWT tokens — header, payload, and algorithm.
About JWT Decoder
JWT Decoder splits a JSON Web Token into its header, payload and signature so you can read claims, check the expiry and debug an auth flow.
It decodes only. The signature is not verified, because verification requires the server's secret or public key.
How to use JWT Decoder
- 1
Paste the token
The full three-part token, with or without the Bearer prefix.
- 2
Read the claims
Header shows the algorithm, payload shows iss, sub, exp and custom claims.
- 3
Check expiry
exp and iat are shown as readable dates next to the raw values.
Questions about JWT Decoder
Does this verify the token?
No. Anyone can craft a payload. Only the server can verify the signature.
Is it safe to paste a real token?
Decoding is local, but a live token is still a credential — treat it like a password and revoke it if exposed.
What does alg: none mean?
It means the token is unsigned. Never accept that on a server.
Why is the payload readable?
JWT payloads are Base64URL, not encrypted. Never put secrets in claims.
Related tools
Last updated November 2026. Files are processed on FilePlume's own hardware and deleted within 60 minutes; nothing is used for training.