JWT Decoder | SparkJSON

This tool does not verify signatures

It decodes the header and payload so you can inspect claims. It never checks the signature against a secret or public key, so a decoded token is not proof that it's authentic or untampered.

JWT

Quick answers

Is it safe to paste a production JWT into this tool?
The decoding happens entirely in your browser and nothing is sent anywhere — you can confirm this in your browser's Network tab. That said, JWT payloads often contain user IDs, emails, or role claims, so treat any token like the sensitive data it usually carries and avoid pasting tokens tied to systems you don't control.
Why can't this tool tell me if a token is valid?
"Valid" for a JWT means the signature checks out against the issuer's secret or public key. That check requires the actual signing key, which should never be typed into a browser tool. This decoder only tells you what the token claims about itself, not whether those claims are trustworthy.

About JWT Decoder

Decode a JSON Web Token's header and payload, see exp/iat/nbf as readable local and UTC timestamps, and get an immediate flag if the token is expired or uses the insecure alg:none. This tool never checks a signature — it decodes, it does not verify.

A JSON Web Token is three Base64URL-encoded segments joined by periods: a header, a payload, and a signature. This tool splits the token on those periods, decodes the header and payload segments back to JSON, and renders them — that's decoding, and it's all that happens here.

Verifying a JWT is a different operation entirely: it means re-computing (or checking) the signature against a secret or public key to confirm the token wasn't tampered with and was actually issued by who it claims. This tool intentionally does not do that, because doing it safely would require you to paste a secret key into a web page — which you should never do, on this site or any other. If you need real verification, do it server-side with a proper JWT library and your actual signing key.

The exp, iat, and nbf claims are Unix timestamps (seconds since epoch) by the JWT spec, so we convert them to both your local timezone and UTC to make it obvious whether a token is expired without you doing the math yourself. Tokens whose header advertises alg: "none" are flagged in red — that algorithm means "no signature at all," and a handful of real-world JWT libraries have historically had vulnerabilities around trusting it.

Frequently asked questions

Is it safe to paste a production JWT into this tool?

The decoding happens entirely in your browser and nothing is sent anywhere — you can confirm this in your browser's Network tab. That said, JWT payloads often contain user IDs, emails, or role claims, so treat any token like the sensitive data it usually carries and avoid pasting tokens tied to systems you don't control.

Why can't this tool tell me if a token is valid?

"Valid" for a JWT means the signature checks out against the issuer's secret or public key. That check requires the actual signing key, which should never be typed into a browser tool. This decoder only tells you what the token claims about itself, not whether those claims are trustworthy.

What does an expired token look like here?

If the payload has an exp claim in the past relative to your device's clock, you'll see a red "Expired" badge next to the decoded output, along with the exact expiry time in both your local timezone and UTC.