JWT Decoder
Decode any JWT's header and payload, read expiry timestamps as plain dates, and inspect the signature — without verifying it. Free, entirely in your browser.
⚠️ This token claims to be unsigned (alg: none) — see the FAQ below.
🔒 Your code never leaves the browser — not one character is sent anywhere, and nothing is stored
How to use it
- Paste the full JWTIt must consist of three parts separated by dots: Header.Payload.Signature.
- Read the Header and Payload as formatted JSONEach part is decoded and formatted automatically beneath its box.
- Check the timestamps if presentiat, nbf and exp appear as readable dates under the payload box.
- Copy the part you needA separate copy button sits under each box — Header, Payload or Signature.
Enjoying the tool? Help us keep it free forever — Support OMXHub ❤️
Frequently Asked Questions
Do you verify the signature?
No, and it’s important to be upfront about that. Verifying a signature requires the secret or public key that issued the token — a tool like this shouldn’t ask for it, and you shouldn’t paste it into a browser in the first place; a key like that belongs on your server only. "Decoded successfully" means the three parts are syntactically valid and readable, not that the token is authentic or trustworthy. Anyone can craft a token with any content they like — the signature is what proves who issued it, and that verification must happen on the party that knows the key.
What do exp, iat and nbf mean?
All three are dates stored as seconds since 1970 (Unix time): iat is when the token was issued, nbf is the earliest moment it’s valid (not before), and exp is when it expires. If any of them appear in the payload, we convert them to a readable date below the payload box.
I see an "alg: none" warning under the Header box — what does it mean?
"none" means the token itself claims to have no signature at all. This is a historically known vulnerability: some libraries used to trust the header’s own algorithm claim and accept unsigned tokens as legitimate. We raise the warning even if it’s written "None" or "NONE" in different casing, because real attacks used exactly that trick.
If the token is expired, will you tell me?
We show the exp value as a readable date under the payload box, and comparing it to the current time is up to you — we don’t judge the token against your clock or label it "expired" or "valid", because that verdict depends on when you read the result, not on the token’s contents.
Can you issue a new token from the values I edit?
No. The tool is read-only — it decodes and displays; it never re-signs or issues a token. Editing the payload box changes neither the original token nor produces a valid new one; the signature makes the token impossible to modify without the secret key in the first place.
Is the token uploaded to a server?
No, not a single character. Decoding happens entirely inside your browser from the first paste.