MotionShine01 / Header
How it was signed
Usually the algorithm (alg) and the type (typ).
Free tool
JWT decoder, header, payload, expiry.
Paste a JSON Web Token to see its header and payload as formatted JSON, with the issued, not-before and expiry times shown as dates and the token flagged if it has expired. "Bearer " at the start is ignored. Decoding only reads the token: it does not check the signature, so a decoded token is not proof that it is genuine. The token stays in this page.
Header
Payload
Signature (not checked)
Decoded in your browser. The token is never sent anywhere or saved.
What a JWT is
Three parts, dot separated.
02 / Payload
The claims
Who it is about (sub), who issued it (iss), when it expires (exp), and anything else the issuer added.
03 / Signature
Proof, if checked
Only someone with the secret or public key can check it. This page does not.
Questions
Good to know.
How do I decode a JWT?
Paste it. The header and payload show at once.
Does this verify the signature?
No. It only decodes. Verify on your server with the right key.
Is it safe to paste a real token?
The token stays in this page and is not sent or saved. Still, treat live tokens like passwords.
Why does it say expired?
The exp time is in the past, by your computer's clock.
What does alg none mean?
The token has no signature at all. Servers should reject it.