# JWT Decoder

Decode a JWT and read its header, payload and expiry in plain language. The token stays in your browser, which matters because a JWT is a live credential.

Canonical page: https://filetity.com/jwt-decoder

## Capabilities

- Free: Yes, with no watermark and no page limit.
- Account required: No. There is no account system.
- Processed on device: Yes. The file is read by your browser and never uploaded. There is no server to send it to.
- Formats: A JWT, with or without the Bearer prefix. A five segment JWE is named as encrypted rather than reported as broken.
- Limits: The signature is shown but never checked, and no key is ever asked for. Length is limited only by what fits in a text box.
- Mobile: Yes, on any modern mobile browser. Large files are limited by the memory the phone gives the browser.
- Offline: Yes, once the page has loaded. The tool keeps working with no network connection.

## Questions

### Is it safe to paste a token into a decoder?

Into this one, yes, because it never leaves the tab: no request is made and there is nothing here to receive it. Into a decoder that posts it to a server, no. A working token is a live credential, and whoever receives it can act as you until it expires, which is why the honest version of this tool runs on your own machine.

### Why can it not tell me whether the token is valid?

Because validity is the signature, and the signature can only be checked with the key it was made with. That key is the one your server signs every token with, so pasting it into a web page gives a stranger the power to issue tokens your systems will accept. No page that asks for your signing key should get it.

### What does alg none mean?

That the token carries no signature at all, so anybody can edit the payload and the token still looks well formed. It exists in the specification for tokens whose integrity is guaranteed some other way, and it has been the root of real authentication bypasses in libraries that accepted it by default. A token arriving with it is worth investigating.

### My token shows as expired but it still works. Why?

The clock. exp is compared against this device's time, and a machine running a few minutes fast will call a token expired slightly early, while most servers allow a small amount of skew in the other direction. If the dates look wildly wrong rather than slightly, check whether the value was written in milliseconds, which is a common bug and puts the expiry fifty thousand years out.

## Related tools

- [Base64 decode and encode](https://filetity.com/base64-decode): Decode base64 to text, or encode text to base64, without leaving the page.
- [JSON Formatter and Validator](https://filetity.com/json-formatter): Format, beautify, validate and read JSON, and find the line that broke it.