JWT Decoder
Paste a JSON Web Token to see its decoded header and payload. Runs entirely in your browser — your token never leaves your device.
—
—
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three base64url-encoded, dot-separated parts:header.payload.signature. The header describes the token type and signing algorithm, the payload carries the actual claims (e.g. user ID, expiry), and the signature lets the issuer verify the token hasn't been tampered with.
Decoding vs. verifying
This tool decodes — it reads the header and payload so you can inspect them. It does not and cannot verify the signature, since that requires the issuer's secret or public key. Treat any claims you see here as unverified until your backend checks the signature.
Common use cases
- Debugging why an API call is being rejected as unauthorized
- Checking whether an access token has expired (see the epoch converter for raw timestamp math)
- Inspecting what claims/scopes a token actually grants during development
Frequently asked questions
- Is my token sent to a server?
- No. Decoding happens entirely in your browser with client-side JavaScript — the token you paste never leaves your device or gets logged anywhere. You can verify this by disconnecting from the network after the page loads; the tool keeps working.
- Does this verify the token's signature?
- No — this tool only decodes the header and payload, which are just base64url-encoded JSON and not encrypted. Verifying a signature requires the secret key or public key used to sign it, which only your backend should have.
- Why can anyone read a JWT's contents?
- A JWT's header and payload are encoded, not encrypted — anyone with the token can decode them, which is exactly what this tool does. Never put secrets (passwords, API keys) in a JWT payload; rely on the signature only to verify the token wasn't tampered with.
- What do exp, iat, and nbf mean?
- They're standard registered claims: iat (issued at), exp (expiration time), and nbf (not before) — all Unix timestamps in seconds. This tool decodes and displays them as readable dates automatically when present.