JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties, used widely for authentication and authorization in modern web applications and APIs. A JWT has three parts separated by dots: a header describing the signing algorithm, a payload containing the claims (data), and a signature that verifies the token was not tampered with.

The header and payload are Base64URL-encoded JSON — not encrypted — so anyone can read them. Our JWT Decoder splits the token, decodes those two sections into formatted JSON, and shows the signature separately so you can inspect exactly what a token contains.

How to Decode a JWT

• Paste your token, or click Sample to load an example JWT
• The header and payload are decoded into readable, formatted JSON
• Standard claims — issued at (iat), expires (exp), not before (nbf) — are shown as local dates
• The tool indicates whether the token has expired based on its exp claim
• Click Copy on the header or payload to copy that section

Decoding vs Verifying

This tool decodes a JWT — it reads and displays the contents — but it does not verify the signature. Verification requires the secret key or public key used to sign the token and confirms the token is authentic and untampered. Decoding alone simply reveals the claims, which is exactly what you need when debugging.

Because the payload is only encoded and never encrypted, you should never store sensitive secrets in a JWT payload. This decoder makes that point obvious: every claim is plainly visible to anyone who has the token.

Privacy & Security

Decoding happens entirely in your browser — your token is never sent to any server, logged, or stored. This is essential for a JWT tool, since tokens often grant access to real accounts. You can safely inspect production tokens knowing they never leave your device.