JWT Decoder
Paste a JSON Web Token to decode its header and payload from base64url into readable JSON. The signature is not verified - this only reads claims, and everything stays in your browser.
Loading…
About the JWT Decoder
A JSON Web Token is three base64url-encoded parts joined by dots: a header, a payload, and a signature. This tool splits the token, decodes the header and payload from base64url back into readable JSON, and shows the claims inside - things like iss, sub, exp, and any custom data. It is the quickest way to see what an access token actually contains while debugging auth flows.
How to use it
- Paste the full token, including all three dot-separated parts.
- Read the decoded header to see the algorithm and type.
- Read the payload to inspect the claims and expiry.
- Compare claims against what your application expects.
This is a decoder, not a verifier: it does not check the signature, so a decoded token is not proof that it is authentic or untampered - always verify signatures server-side with the signing key. JWT payloads are only encoded, not encrypted, so never assume they are secret. Decoding runs entirely in your browser, so your tokens are never uploaded.
Frequently asked questions
Does this JWT decoder verify the signature?
No. It only decodes the header and payload so you can read the claims. It does not validate the signature, so a token decoding successfully does not mean it is authentic.
Can it read the expiry of my token?
Yes. If the payload includes the standard exp claim, it appears in the decoded JSON as a Unix timestamp that you can compare against the current time.
Is the JWT payload encrypted?
No. The header and payload are only base64url-encoded, not encrypted. Anyone with the token can read them, so never store secrets in a JWT payload.
Is my token sent to a server when I decode it?
No. Decoding happens entirely in your browser, so your token and its claims are never uploaded.