JWT Decoder
Paste a JSON Web Token to see its decoded header and payload. Runs entirely in your browser — the token is never sent anywhere.
This only decodes the token's contents — it does not verify the signature. A decoded token is not proof that it's genuine or hasn't been tampered with.
How it works
A JWT is three Base64URL-encoded segments separated by dots: a header, a payload, and a signature. The header and payload are just JSON — anyone can decode them without a secret key, which is exactly what this tool does, entirely in your browser. The signature segment is what actually proves a token is genuine, and decoding it doesn't verify anything; only whoever holds the signing secret (or public key) can do that.
Common claims
exp— expiration time (shown converted to a readable date above)iat— issued-at timesub— the subject the token is about, often a user IDiss— who issued the token
Frequently asked questions
Does this verify the token's signature?
No — it only decodes the header and payload, which anyone can read without a secret key. Verifying a signature requires the secret or public key used to sign it, which this tool never asks for or needs.
Is my token uploaded anywhere?
No — decoding happens entirely in your browser. Since a JWT often contains sensitive claims, that matters: nothing is sent to a server.
Why did it say this isn't a valid JWT?
A JWT always has exactly three dot-separated parts (header, payload, signature). If your input has more, fewer, or parts that aren't valid Base64URL-encoded JSON, it can't be decoded.