cv.cm
All lessons

Developer tools

How to read a JWT

You need to see the claims. You will paste the token in this tab, read alg and the payload, and close the tab. Decoding shows JSON. It leaves the signature unchecked.

6-minute read

Today's result A header and a payload you can read, plus an expiry line that only compares exp with the clock.

Open the JWT decoder when the token is on the clipboard. Three parts separated by dots is the usual shape. The signature stays unchecked. Nothing is uploaded.

Open JWT decoder
Contents

  1. Reading shows JSON. The signature stays unchecked

    Anyone can change the payload and encode it again. This page shows the JSON. It does not check the signature, the issuer, or the audience. A tidy payload is a reason to read it, and a reason to verify it somewhere that holds the key.

    Decode shows JSON. The signature stays unchecked. Verify where the key lives.
    Decode shows JSON. The signature stays unchecked. Verify where the key lives.

  2. Open the JWT decoder on cv.cm

    Decoding stays in this tab.

    Open JWT decoder

  3. Paste the token

    The usual shape is three parts separated by dots. Two parts can still decode. A live access token can hold an email or a user id. Keep it off chat, and keep this tab off a shared screen.

  4. Read alg and the claims

    alg is a label, including the word none. It is a label only. Look for iss, aud, sub, and exp. If the page cannot decode it, the header or the payload is not base64url JSON.

  5. Expired compares exp with the clock

    exp is seconds. If that instant is in the past, the line says expired. Missing exp means there is no expiry claim to compare. In both cases the signature stayed unchecked.

    Expired compares exp with the clock. The signature stayed unchecked.
    Expired compares exp with the clock. The signature stayed unchecked.

  6. Close the tab

    Closing discards the token from this page. When you need a trusted token, verify it where the secret or the public key lives. This page has neither.

Use with these tools

FAQ

Can I decode a JWT free online?

Yes. cv.cm reads the header and payload in this tab. Nothing is uploaded.

Do you verify the signature?

No. You get JSON you can read. The signature, the issuer, and the audience stay unchecked.

What does expired mean?

The exp claim, in seconds, is before now. It is a clock compare. Missing exp means there is no expiry claim. Neither case checks the signature.

Why did decode fail?

The value needs two or three parts separated by dots, and the header and payload must be base64url JSON.

Is the token uploaded?

No. Closing the tab discards it. Keep a live access token off chat and off a shared screen.