JWT Decoder

What is inside a token

A JSON Web Token is three Base64 sections separated by dots. The header states the signing algorithm, the payload carries the claims such as who the user is and when the token expires, and the third part is the signature. Decoding shows you the first two, which is what you want when debugging why an API is rejecting a request or when checking whether a token has already expired.

Decoding is not verifying

This is the single most important thing to understand about JWTs. The header and payload are only encoded, not encrypted, so anyone holding a token can read them without any key at all. What makes a token trustworthy is the signature, and checking it requires the secret or public key. So a decoder tells you what a token claims, never whether those claims are genuine. Any server that trusts a payload without verifying the signature is wide open.

Handling real tokens safely

• A JWT is a live credential. Anyone with it can act as that user until it expires.
• Never paste a production token into a site that sends it to a server, because you cannot know whether it is logged.
• This decoder parses entirely in your browser, so the token does not leave your machine.
• Never put anything sensitive in a payload, since it is readable by anyone.
• If a token has been exposed, revoke or rotate it rather than hoping.