How to Read a JWT Login Token Safely

Developer · Step-by-step guide · 3 steps · 2 min read

A JWT is a login token that apps pass around. It holds facts, like who you are and when the token runs out. This tool shows what is inside a JWT.

Open the JWT Decoder

In the pictures, orange letters like A show where to look. Each step tells you its letter.

Step 1: Paste your token

Paste the token into JWT Token. It is read right away. There is no button to press. See A in the picture.

JWT Decoder with a sample token and an empty secret box — The token (A) and the secret for checking it (C).

Step 2: Read the parts

The header and the payload show as easy-to-read text. Times like exp (when it runs out) are explained. You also see a countdown. See B in the picture.

The token's header and payload shown as text — The header and payload (B).

Step 3: Check the signature (optional)

Do you know the secret for the token? Type it into Verify signature. The tool then checks that no one changed the token. This works for HS256, HS384 and HS512. See C in the picture.

Tips and questions

Is it safe to paste a real token?

The token is read in your browser and not sent anywhere. Still, treat real tokens like passwords. Do not share screenshots of them.

Does reading a token prove it is real?

No. Anyone can read a JWT. Only a signature check with the right secret proves it is real.

Can I make a test token?

Yes. Open the Builder tab. Pick a type, add your facts and press Build JWT. The +1h exp button sets it to run out in one hour.

Privacy

Your token and secret stay in your browser. Nothing is sent to us or saved.

Try it now

The JWT Decoder is free. You do not need an account.