A JSON Web Token (JWT, defined in RFC 7519) is a compact way to pass claims between systems, such as who a user is and when their session ends. It is three base64url parts joined by dots: a header naming the algorithm, a payload with the claims, and a signature.
A signed token (JWS) can be read by anyone who has it; the signature only shows whether it was changed. An encrypted token (JWE) has five parts, and its payload can't be read without the key. Most tokens in APIs are signed, not encrypted.
Decoding is not verifying
Decoding only turns base64url back into text, so this tool can show any token's contents, but it can't tell you whether the token is genuine. Anyone can write a header and a payload and encode them. Only the signature, checked with the right key, shows who made a token and that nobody changed it.
Before trusting a token, a server must verify its signature with the expected algorithm and key, and then check exp, aud and iss. A token decoded on this page proves none of that.
The registered claims
RFC 7519 defines seven registered claims. iss is the issuer, sub the subject (usually a user ID), aud the audience the token is meant for, and jti a unique ID. exp, nbf and iat are times: when the token expires, when it starts being valid, and when it was issued.
Those times are numbers of seconds since 1 January 1970 UTC, not milliseconds: “1700003600” is 14 November 2023 23:13:20 UTC. A token is expired from the second of exp, and not valid before the second of nbf. The tool compares them with your computer's clock and shows each in UTC, in your time zone and as a relative time.
The none algorithm
The header's alg can be “none”, which means the token has no signature at all. Such a token is just text anyone could have written, so a server should never accept it; some libraries once did, which let forged tokens through. This tool flags alg none in any capitalisation.
Privacy
The token is decoded by JavaScript on this page. This tool doesn't send it anywhere or store it, not even in the address bar or your browser's storage. Like the rest of the site, the page records a visit when it loads, but not your token. Tokens are credentials, so prefer test tokens to production ones.
How to use
- Paste a token, with or without the Bearer prefix, or load the synthetic example.
- Read the header, the payload and the claims table; the time badge shows what exp and nbf say now.
- Copy the header or the payload JSON with its own button.
Features
- Formatted header and payload JSON, with big numbers and duplicate keys kept as written and flagged.
- Times in UTC, your time zone and plain words, with a note when a value looks like milliseconds.
- Specific errors for wrong characters, impossible lengths and the wrong number of parts.
Common uses
- Inspecting test tokens. Read the claims of tokens from test and staging environments.
- Debugging 401 responses. Check exp, nbf and aud when an API test suddenly fails with 401 Unauthorized.
- Asserting claims in API tests. See the roles, scopes or tenant in a token before you write the assertion.
Frequently asked questions
What is a JWT?
A JSON Web Token: a header, a payload of claims and a signature, each base64url-encoded and joined by dots. It is defined in RFC 7519 and is often sent in an Authorization header.
Is a JWT encrypted?
Not by default. A signed token's header and payload are only encoded, so anyone who has the token can read them. Only an encrypted token (JWE, with five parts) hides its payload.
Can I trust a decoded token?
No. Decoding shows what a token says, not who wrote it. Trust comes from the server verifying the signature with the right key, then checking exp, aud and iss.
What are exp, nbf and iat?
Times in seconds since 1970: exp is when the token expires, nbf when it starts being valid, and iat when it was issued.
Why does my token show as expired?
Its exp is at or before the current time on your computer. Access tokens often last only minutes. Also check your clock, and whether exp was written in milliseconds by mistake.
What is the none algorithm?
An alg value meaning the token has no signature. Anyone can forge such a token, so it must never be accepted.
Is my token uploaded?
No. It is decoded in your browser, and this tool doesn't send or store it. The page itself records a visit when it loads, as every page here does.
Need to test a whole website, not just a snippet?
RoboQA tests real pages and user journeys in a browser: logins, forms, clicks and full flows. See what RoboQA can test or compare plans.