JWT Decoder Online
Decode a JWT's header and payload instantly — entirely in your browser.
This tool only decodes a JWT — it does not verify the signature. Decoding just reads the header and payload, which anyone can do without a secret key. A token shown here could be expired, tampered with, or entirely forged. Never trust a token's claims without verifying it server-side with the correct secret or public key.
JWT
⚠️ This token's header sets alg: none — it is not signed at all. Some servers have historically (and incorrectly) accepted "none" tokens as valid, letting anyone forge arbitrary claims. Treat this token as having no cryptographic guarantee whatsoever.
Header
Payload
Signature
Shown as-is — a signature can't be decoded or verified without the secret or public key used to create it.
Never uploaded
Decoding happens entirely in your browser — your token never touches our servers.
Decode only, not verify
This tool cannot and does not check the signature — see the warning above before trusting any claim.
Free, no limit
No account, and no limit on how many tokens you can decode.
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe way to represent claims between two parties — commonly used for authentication tokens and session data. It's made of three base64url-encoded segments separated by dots: a header (describing the token type and signing algorithm), a payload (the actual claims — user ID, expiry, permissions, and so on), and a signature (used to verify the header and payload haven't been tampered with).
How to Decode a JWT Online
- Paste your token. A full JWT, including all three dot-separated segments.
- Read the decoded header and payload. Both update instantly, shown as readable JSON.
- Check the claims. Expiry, issued-at, and not-before times (if present) are shown with a readable date and an expired/valid badge.
- Copy what you need. The header and payload panels each have their own Copy button.
Decoding Is Not Verifying
This is the single most important thing to understand about any JWT decoder, including this one: decoding a JWT proves nothing about whether it's genuine. The header and payload are just base64-encoded JSON — no secret key is needed to read them, which is why this tool (and every other JWT decoder) can show you their contents instantly. The signature is what actually proves a token came from a trusted source and hasn't been altered, and checking it requires the same secret key (or public key, for asymmetric algorithms) the token was signed with — something only your server should have. Always verify JWTs server-side before trusting anything they claim.
Frequently Asked Questions
How do I decode a JWT?
Paste a JWT (three base64url segments separated by dots) into the box — the header and payload are decoded and shown as readable JSON instantly.
Does this tool verify the JWT's signature?
No — this is a decoder, not a verifier. It does not check the signature, so a decoded token could be expired, tampered with, or entirely forged. Never trust a token as authentic just because it decoded successfully.
What does "alg: none" mean, and why is it flagged?
"none" means the token isn't signed at all. Some server implementations have incorrectly accepted alg:none tokens as valid, letting an attacker forge any claims they wanted — this tool flags it clearly.
What are the exp, iat, and nbf claims?
exp (expiration) is when the token stops being valid, iat (issued at) is when it was created, and nbf (not before) is when it becomes valid. Each is shown as a readable date with a relative description when present.
What happens if I paste an invalid JWT?
You'll see a clear error message explaining what's wrong, rather than a blank or broken result.
Is my token uploaded anywhere?
No. Decoding happens entirely in your browser — your token is never sent to CurePDF's servers.
Is the JWT decoder free?
Yes, with no account required and no limit on how many tokens you can decode.
Can I copy the decoded header or payload?
Yes — both the header and payload panels have their own Copy button.