Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
JWT Decoder · runs in your browser
Decode a JSON Web Token in your browser, check expiry and algorithm, and see which claims anyone holding the token can read.
Decoding happens in your browser. The signature is not verified here: anyone can read a JWT, only the server with the key can check it. Never paste live production tokens into websites you do not trust, including this one.
Header
Payload
Claims and checks
Read the background
The 2025 edition of the OWASP Top 10 reorders the classic web risks and adds a new one about error handling. What each category means, how it shows up in real code and what stops it.
High impact6 min
JSON Web Tokens are compact and convenient, and easy to get subtly wrong. What a token contains, which checks every verifier must make and when a plain session cookie is the better choice.
High impact5 min
More tools
