JWT decoder

Q: Is it safe to paste a real token here?

The token is decoded in your browser and is never sent, stored or logged. A live token is still a credential, so treat it like a password: prefer expired or test tokens, and revoke a live one if you pasted it somewhere you do not trust.

Q: Does this verify the signature?

No. Verifying needs the issuer's secret or public key. Decoding only shows what the token claims; anyone can create a token with any claims, so never trust a decoded payload without verification on the server.

Q: Why is alg “none” dangerous?

A token with alg none has no signature, so its contents can be changed freely. Libraries that accept it let an attacker become any user. Servers must reject unsigned tokens and fix the accepted algorithms.

Q: What do exp, iat and nbf mean?

They are Unix timestamps in seconds: exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. The decoder shows each as a UTC date and warns when exp is missing or the lifetime is very long.

Decode a JSON Web Token's header and payload, see when it expires, and get warned about alg none, missing expiry, jku/kid tricks and sensitive data. The token never leaves your browser.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

JWT (a leading “Bearer ” is fine)

How it works

JSON Web Tokens carry identity and permissions between services, so they turn up in proxy logs, browser storage, API traffic and incident evidence. Their contents are only Base64url-encoded, not encrypted, which means anyone holding a token can read it.

Paste a token and the decoder shows its header and payload, converts the time claims to dates, and checks for the problems that matter in security reviews: unsigned tokens (alg none), HMAC secrets that could be cracked offline, headers that point at attacker-controlled keys (jku, x5u, an embedded jwk), key IDs that look like injection attempts, missing or excessive expiry, and sensitive data such as passwords in the payload. Encrypted tokens (JWE) are recognised too. Nothing is sent anywhere.

Questions

Is it safe to paste a real token here?

The token is decoded in your browser and never sent, stored or logged. A live token is still a credential that can be replayed, so treat it like a password: prefer expired or test tokens, and revoke a live one if it was ever pasted somewhere you do not trust.

Does this verify the signature?

No. Verification needs the issuer’s secret or public key. Decoding only shows what a token claims, and anyone can create a token with any claims, so a server must always verify the signature before trusting the payload.

Why is alg “none” dangerous?

A token with "alg": "none" has no signature, so its contents can be changed freely. A server whose library accepts it lets an attacker become any user. Servers should reject unsigned tokens and accept only the algorithms they expect.

What do exp, iat and nbf mean?

They are Unix timestamps in seconds: exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. The decoder shows each as a UTC date and warns when exp is missing or the lifetime is very long.