Orpheus

JWT Decoder

Read a token’s header and claims, entirely in your browser.

Options
Show timestamps as dates
Result

Everything is processed in this tab. Nothing you paste is sent anywhere.

Every tool runs entirely in your browser. Your files are never uploaded to a server.

A JWT has three Base64URL parts separated by dots: header, payload and signature. The first two are encoded, not encrypted — anyone holding the token can read every claim in it without a key.

How to use JWT Decoder

  1. Paste the token. The whole thing, including both dots.
  2. Read the claims. Header and payload are shown as formatted JSON, with expiry as a readable date.

About decoding a JWT

A JSON Web Token is three Base64URL-encoded segments joined by dots: a header naming the algorithm, a payload of claims, and a signature over the first two. The single most important property to understand is that only the signature is cryptographic. The payload is encoded, not encrypted, and anyone who obtains the token can read every claim in it in a second — which is why putting an email address, an internal user role or anything else sensitive in a JWT is a disclosure rather than a design choice. The signature guarantees integrity and origin, not confidentiality. That property is also why pasting a token into a random online decoder is a genuine risk rather than a theoretical one: a JWT is usually a live session credential, and handing it to a third-party server is handing over the ability to act as that user until it expires. Decoding it locally removes the question. Two other things worth knowing. The alg header field was the source of a well-known class of vulnerability, where a server trusted the token to declare its own algorithm and could be handed one claiming "none". And expiry is enforced by the receiving system, not by the token — a JWT with a past exp is still perfectly readable, which is why revocation is genuinely hard.

Frequently asked questions

Is a JWT encrypted?
No. The header and payload are Base64URL encoded, which is reversible by anyone. The signature proves the token was not altered and was issued by someone holding the key — it does not hide the contents. Never put anything secret in a JWT payload.
Is it safe to paste a token into an online decoder?
Into this one, yes, because decoding happens in the page and nothing is transmitted. Into others, assume the token has been seen by that server — and a JWT is a live credential, so treat pasting one into an unknown site as leaking it.
Does this verify the signature?
No, and it deliberately does not ask for your key. Verification requires the secret or public key, and a tool that asked you to paste one alongside the token would be asking for the two halves of your authentication scheme.
What do exp, iat and nbf mean?
Expiry, issued-at and not-before, all as Unix timestamps in seconds. They are shown here as dates because a ten-digit integer tells you nothing at a glance, and expiry is the claim people are usually checking.

Last updated