Read JWT
Paste a token and see what it contains. We do not verify the signature, and never will: doing so would need your secret key, and this is not a place to paste one.
Your text stays on your device: nothing is uploaded
Result
Paste something on the left: the result appears as you type.
How it works
The first two parts of a token are just encoded text: anyone can read them, no keys needed. That is not a flaw — a token is not meant to hide what it contains, but to stop it being modified. The signature is not verified here: that would need the server’s secret key, and a website is no place to paste one. So what you read tells you what someone wrote in the token, not that it is true. Dates are converted for you, and we tell you if it has expired or is not valid yet.
Frequently asked questions
- Can I paste the whole Authorization header?
- Almost: a “Bearer” prefix in front of the token is removed for you. Anything else is not, so delete “Authorization:” and any quotes. If you are told a part is not Base64, extra text is usually still attached; if the three parts are missing, the token was probably cut short when you copied it.
- Which time zone are the dates in, and how is expiry decided?
- iat, nbf, exp, auth_time and updated_at become UTC dates, marked by the trailing Z. Expiry (exp) and start of validity (nbf) are checked against your device’s clock: if that is fast or slow, so is the verdict. If one of these dates is not written as a number of seconds, as the standard requires, we tell you instead of ignoring it. To read a date in your own time, paste it into “Convert timestamp”.
- My token has five parts: why can’t it be read?
- A five-part token is encrypted, not just signed: its contents are hidden and can only be read with the right key. This page reads signed tokens, the three-part kind. To find out what an encrypted one holds, you need the service that created it.
- What does “alg: none” mean?
- That the token is not signed: the third part is empty, and anyone could have written or changed it. You can read it here like any other, and the declared algorithm appears under the result. A service that accepts such tokens without complaint trusts whatever they say, and its configuration needs fixing.
What you paste is never uploaded. Anywhere.
The text you type stays in your browser’s memory: no request goes out while you type. You can paste something confidential.
- Processed locallyEverything happens on this page.
- Nothing to upload, nothing to wait forNothing to upload, no waiting.
- Nothing to deleteWe keep nothing: nothing reaches us.