JWT Decoder
Decode a JSON Web Token to read its header and payload — no signature verification.
This tool only decodes the token in your browser. It does not verify the signature — never trust a decoded JWT without server-side verification.
What is a JWT?
A JSON Web Token is three base64url-encoded parts separated by dots: a header, a payload of claims, and a signature. It is widely used to carry login sessions and API authorisation. The header and payload are only encoded, not encrypted, so anyone can read them — which is exactly what this tool does.
Decoding is not verifying
This decoder splits the token, base64url-decodes the first two parts and pretty-prints the JSON. It
does not check the signature, so it cannot tell you whether a token is authentic or
has been tampered with. Always verify the signature on your server with the secret or public key before
trusting any claim. Standard time claims such as iat and exp are shown as
readable dates.
How to use the JWT Decoder
- Paste the token. Drop the full JWT, including all three dot-separated parts.
- Click Decode. The header and payload are decoded and pretty-printed.
- Inspect the claims. Read the JSON and the human-readable iat, nbf and exp dates.
- Verify server-side. Remember to check the signature in your backend before trusting it.
Frequently asked questions
Does this verify the signature?
No. It only decodes the header and payload. Signature verification needs the secret or public key and must happen on a trusted server.
Is it safe to paste a real token here?
Decoding is fully local and nothing is uploaded, but a JWT can grant access, so avoid pasting live production tokens into any web tool.
Why can I read the payload so easily?
JWT parts are base64url-encoded, not encrypted. Encoding only obscures formatting, so never store secrets in a JWT payload.
What do iat and exp mean?
They are "issued at" and "expires" times in Unix seconds. The tool converts them to readable UTC dates and flags whether the token has expired.