No, and this is the most common misunderstanding about them. A standard JWT is base64url-encoded and signed. The signature stops anyone modifying the claims without detection, but it does nothing to hide them — the payload can be read by anyone holding the token, using nothing more than this page. If you need the contents hidden, that is JWE, a different and much less common format.

JWT Decoder

Q: Is it safe to paste a JWT into a website?

In this tool the decoding happens entirely in your browser — nothing is uploaded, logged or stored, and you can verify that by disconnecting from the network and watching it still work. That said, the honest general answer is to be careful: a JWT is a live credential, many online decoders do send it to a server, and a token that authorises anything valuable should be treated as compromised once it has been pasted anywhere. For production tokens, decode locally or use a short-lived test token.

Q: Why can't this tool verify the signature?

Because verifying requires the signing secret for HMAC algorithms, or the public key for RSA and ECDSA. Asking for your HMAC secret would mean asking you to paste the credential that lets anyone mint valid tokens for your system, and normalising that is genuinely harmful regardless of whether a particular site is trustworthy. Verification belongs on your server, where the key already lives.

Q: What does alg:none mean and why is it dangerous?

It declares that the token is unsigned, and the signature segment is empty. The JWT specification allows it for cases where integrity is guaranteed by other means, but the practical effect is that anyone can write a token by hand claiming to be any user with any role. If a server trusts the header's alg field to decide how to verify, an attacker simply sets it to none and authentication is bypassed entirely. Always pin the expected algorithm in your verification code rather than reading it from the token.

Q: Why is my token expired when the server just issued it?

Usually clock skew or a units bug. If the issuing server's clock is ahead of the verifying server's, a freshly issued token can have an iat in the future and an nbf that has not arrived yet — this tool flags both. The other cause is exp set in milliseconds rather than seconds, which makes the token appear to expire tens of thousands of years from now and can confuse libraries that range-check it. The analysis catches that case explicitly.

Q: How long should a JWT live?

Short, because a JWT cannot be revoked. Once issued it stays valid until it expires — there is no list to remove it from without adding server-side state, which defeats much of the point of using one. Access tokens are commonly 5 to 60 minutes, paired with a longer-lived refresh token that can be revoked because it is checked against a database. This tool warns when a token's lifetime exceeds a year, since a leak then stays exploitable until you rotate the signing key.

Decode a JSON Web Token and see its claims, expiry and the problems hiding in it.

Paste your token

A "Bearer " prefix is fine — it gets stripped. Your token is decoded in this page and never sent anywhere.

What It Does

This tool splits a JSON Web Token into its three parts, decodes the header and payload from base64url, and then tells you what is actually wrong with it: whether it has expired and how long ago, whether the algorithm is one an attacker can exploit, and whether there is personal data or a credential sitting in a payload that anyone holding the token can read. It decodes only — it never asks for your signing secret, and the token never leaves your browser.

When to Use It

A request is returning 401 and you need to know whether the token expired or the claims are wrong.
You are reviewing an authentication flow and want to see exactly what a service is putting in its tokens.
You inherited an API and need to work out which claims it issues and how long its tokens live.
You want to check that a token you generate does not contain personal data before it ships.

Worked Examples

An expired HS256 token

The ordinary case. The analysis says how long ago it expired and gives the absolute time in your own timezone — which is usually the answer to why a request started returning 401.

A token signed with alg:none

No signature at all, and note the empty third segment. Anyone can write this token by hand with any claims they want. If your server accepts it, authentication is completely bypassed — this is the best-known JWT vulnerability.

A token leaking personal data

An email and a password sitting in the payload. Both are flagged, because a JWT payload is base64-encoded, not encrypted — anyone holding this token can read them with no key at all.

Timestamps in milliseconds

JWT times are seconds since the epoch, but this backend passed Date.now() straight in. The token appears to expire in the year 57000, so it never expires in practice — a bug that is invisible until you decode it.

Common Mistakes

Believing a decoded token is a verified token. Decoding proves only that the base64 was well-formed. Anyone can change the payload of an unsigned-looking token and re-encode it — only checking the signature against your key proves it is genuine, and that has to happen on your server.
Putting personal data in the payload. A JWT is signed, not encrypted: the payload is readable by anyone who holds the token, including the browser it is stored in and every proxy it passes through. Emails, phone numbers and internal identifiers all leak this way.
Using milliseconds for exp, nbf and iat. The spec says seconds since the epoch. Passing Date.now() gives a value a thousand times too large, and the token silently never expires rather than failing loudly.
Accepting alg from the token itself. If your server reads the header to decide how to verify, an attacker sets alg to none — or swaps RS256 for HS256 and signs with your public key as the HMAC secret. Pin the expected algorithm in your verification code.
Storing a large token in a cookie. Browsers cap a single cookie at around 4 KB and many proxies cap the whole header block at 8 KB. A token that grows past that gets truncated or dropped, usually in production and usually for the users with the most claims.

Features

Decodes header

payload and signature

Colour-coded view of the three segments

Expiry and not-before checks with absolute and relative times

alg:none and algorithm-family warnings

Detects seconds-vs-milliseconds timestamp bugs

Flags emails

phone numbers

card numbers and credentials in the payload

Luhn-checked card detection to avoid false alarms

Cookie and header size warnings

Accepts a pasted Bearer prefix

Runs entirely in your browser

How to Use

1. Paste your token — a leading 'Bearer ' is fine, it gets stripped. 2. The header and payload decode immediately, with the three segments colour-coded above. 3. Read the analysis panel: expiry first, then algorithm, then anything found in the payload. 4. Copy the header or payload JSON if you need it elsewhere. Nothing is uploaded at any point.

Frequently Asked Questions

Is it safe to paste a JWT into a website?

Why can't this tool verify the signature?

What does alg:none mean and why is it dangerous?

Is a JWT encrypted?

Why is my token expired when the server just issued it?

How long should a JWT live?

Embed this JWT Decoder

Paste this snippet into your site to embed the tool.

<iframe src="https://webtoolworld.com/embed/jwt-decoder" style="width:100%;min-height:560px;border:0" loading="lazy" title="JWT Decoder"></iframe>
<p style="font-size:12px;margin-top:6px"><a href="https://webtoolworld.com/jwt-decoder">JWT Decoder</a> by WebToolWorld</p>

This tool decodes; it does not verify. Verifying a signature requires the signing secret or private key, and this tool deliberately does not ask for one — pasting production secrets into any website is a habit worth not forming. A successfully decoded token tells you nothing about whether it is genuine. Everything runs in your browser: your token is never uploaded, logged or stored. Even so, treat any token you paste anywhere as potentially compromised, and rotate it if it protects something that matters.

JWT Decoder

Header

Payload

Signature