Does 'decoded successfully' mean the token is valid?

No — it means the token is well-formed Base64url that decodes to JSON. Validity requires checking the signature against the issuer's key, which this tool deliberately does not attempt, since doing so without a key would only create a false sense of assurance.

Why can't it read an encrypted token (JWE)?

A signed token (JWS) has a readable header and payload with an opaque signature; an encrypted token (JWE) has an unreadable payload by design, encrypted rather than just signed. That's a different format with five segments, not the three this tool expects.

JWT Decoder

A token is three Base64url segments separated by dots, and the useful thing to say about one is what it claims and when it expires. The dangerous thing is to imply more: reading a token proves nothing about whether it is genuine, because the signature can only be checked with a key. A decoder that says "valid" when it means "well-formed" is actively misleading, so that word does not appear here.

Your token

Three parts separated by dots. It is never sent anywhere.

The token’s contents will appear here.

What this generator does

Splits the token, decodes the first two parts from Base64url into JSON, explains the registered claims, and turns the timestamps into dates you can read.

How to use this tool

Paste the token — it stays in your browser.
Read the header and the claims.
The standard claims are explained, and the timestamps written out as dates.
Remember that nothing here checks the signature.

Understanding the controls

Your token: The whole token, three parts separated by dots. It is decoded in your browser and never sent anywhere — which matters, because a token is a credential.

Worked examples

A token with a standard claim set: Header decodes to {"alg":"HS256","typ":"JWT"}; payload might carry sub, iat and exp — this tool names each registered claim it recognises and converts iat/exp/nbf from Unix seconds into a readable date.

Common use cases

Seeing what claims a token actually carries
Checking when a token expires, and whether it already has
Working out which algorithm signed a token
Debugging an authentication problem
Understanding the shape of a token from an unfamiliar service

How this generator works

The decoding is checked for faithfulness rather than for authenticity: each segment is turned back into Base64url and must reproduce exactly the characters that were in the token. That catches a segment cut short or carrying stray trailing bits, which are the ways a decoder actually goes wrong; a character outside the URL-safe alphabet, padding included, is refused before that. The signature is reported by length and explicitly not checked, because checking it needs a key.

Randomness and fairness

Nothing is random. The same token always reads the same way.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

The signature is not verified, and cannot be without the key. A token that reads correctly may be entirely forged.
Encrypted tokens, where the payload is not readable at all, are a different format and will not decode here.
Expiry is judged against your device's clock, which may be wrong. A time claim too large or too small to be a calendar date is shown as the number it is, with no date beside it.
A token is a credential. Pasting one anywhere is a risk; here it stays in the browser, but that is worth knowing in general.

Privacy and your data

The token is decoded entirely in your browser and is never transmitted or stored, which matters because a token is a credential.

Frequently asked questions

Does 'decoded successfully' mean the token is valid?: No — it means the token is well-formed Base64url that decodes to JSON. Validity requires checking the signature against the issuer's key, which this tool deliberately does not attempt, since doing so without a key would only create a false sense of assurance.
Why can't it read an encrypted token (JWE)?: A signed token (JWS) has a readable header and payload with an opaque signature; an encrypted token (JWE) has an unreadable payload by design, encrypted rather than just signed. That's a different format with five segments, not the three this tool expects.