Read a token without handing it to a stranger
JSON Web Tokens (JWTs) are used to sign people in to apps and APIs. Pasting a live token into an online decoder gives that site a working key to your account until the token expires. This inspector decodes it in your browser and explains what it says.
What you'll see
- When it expires, when it was issued, and how long it lives.
- Who issued it, who it's for, and which permissions, roles or groups it grants.
- Personal information inside, such as email, name or phone number. JWTs are encoded, not encrypted, so anyone holding one can read it.
- Warnings for unsigned tokens, tokens with no expiry, and very long lifetimes.
Decoding is not verifying
Anyone can write a token that says anything. Only the signature proves it came from the issuer. To check it, paste the shared secret (HS256/384/512) or the issuer's public key as PEM or JWK (RS, PS and ES algorithms); the check runs with your browser's built-in cryptography.
Questions
Is the token sent anywhere?
No. Decoding and the signature check run in your browser.
Can it read encrypted tokens (JWE)?
Only their header. The contents need the recipient's private key.