Decode a JWT in your browser to read its header, claims and signature. Nothing is verified, so use it to inspect a token, not to trust one.
Runs in your browser — your input is processed on this device and never uploaded.
The whole token: three segments separated by dots, without the Bearer prefix. The signature is not checked.
Results appear here.
A JSON Web Token (JWT) is three Base64url segments joined by dots: a header, a payload of claims, and a signature. The header names the signing algorithm in its alg field. The payload carries whatever the issuer put there, usually a subject (sub), an issuer (iss), an expiry (exp) and an issued-at time (iat), plus custom fields. The signature lets the server that holds the key confirm that nobody changed the first two segments.
This JWT decoder splits a token and shows its parts in your browser.
The signature, expiry and not-before time are not checked. A forged or expired token still decodes. Use this page to read a token, not to decide whether to trust it.
APIs adopted JWTs because one compact string can carry identity without a session lookup on every request. The same token travels in an Authorization header, a cookie or a query string. That convenience is also the trap: once you can read the payload, it is tempting to treat its claims as true.
Decoding first is how you catch the usual mistakes. A token with the wrong number of segments, a header that is not JSON, an alg you did not expect, or an exp that already passed shows up here before you wire anything into a verifier.
jwt.io decodes in the browser and can also verify a signature when you give it the key. Libraries such as jsonwebtoken for Node.js and PyJWT for Python decode and verify in code, which is where verification belongs.
The exp, iat and nbf claims are Unix seconds. Paste one into Unix Timestamp Converter on ToolkitBay to see the date. HMAC Generator and HMAC Verifier are the right tools when you have a raw message and a shared secret rather than a JWT.
This page does not sign, verify or decrypt. Encrypted tokens (JWE) have five segments and are refused.
Base64url drops the padding characters, which is why JWT strings never end in =. The payload is encoded, not encrypted, so anyone who sees a token can read every claim in it. Keep secrets out of claims.
The alg header is chosen by whoever made the token. Well-known bugs accepted tokens with alg set to none as already verified, or let an attacker sign with an RSA public key used as an HMAC secret. Decoding shows you that header. Your verifier still has to insist on the algorithm it expects.
Decoding runs in your browser. The token is not sent to ToolkitBay's servers.
Find similar tools by category or tag.