MB Networks
TOOL-16 · Security
JWT decoder
Paste a JSON Web Token to inspect its header, payload, and claims. Runs entirely in your browser — nothing is sent anywhere.
JWT token
Header
Payload
What's actually inside a JWT
A JSON Web Token is three Base64-encoded sections separated by dots: header (algorithm and token type), payload (the actual claims — user ID, expiration, permissions, whatever the issuer put there), and signature (proves the token wasn't tampered with, if you have the secret key). Decoding the header and payload requires no secret at all — they're just Base64, readable by anyone who has the token. The signature is the only part that actually requires a key to verify.
The mistake this makes visible
Because the payload is trivially readable, JWTs should never carry sensitive data (passwords, secrets, anything you wouldn't put in a URL) as plain claims — anyone holding the token can read every field, whether or not they can verify the signature. Pasting a token here and seeing exactly what's inside is the fastest way to catch that mistake in your own tokens.
Can anyone read a JWT's contents without the secret key?
Yes — the header and payload are just Base64-encoded JSON, not encrypted. Anyone holding the token can decode and read every claim inside it. Only the signature (which proves it wasn't altered) requires the secret key.
Why does my token say it's expired when I just got it?
Check the exp claim (Unix timestamp) against the current time, and check for clock skew between the issuing server and whatever's validating the token — a few minutes of drift between servers is a common, often-overlooked cause of premature expiration errors.
Does decoding a JWT here verify its signature?
No — this tool decodes and displays the header/payload, which requires no key, but doesn't verify the signature, which would require the issuer's secret or public key. A readable, correctly-formatted JWT is not the same as a valid, unaltered one.
Related tools
Security
Base64 Encoder / Decoder
Encode and decode Base64 strings in your browser. Supports standard and URL-safe Base64, plus hex input/output. Nothing leaves your device.
Open →Security
Hash / Checksum Verifier
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums for files or text, entirely in your browser. Paste an expected hash to verify a match instantly.
Open →Security
Password Generator
Generate strong random passwords and diceware-style passphrases with entropy display. Uses cryptographically secure randomness. Nothing is logged or sent.
Open →Client-side only · No data sent