Home / Developer / JWT Decoder
JWT Decoder
Paste a JSON Web Token to inspect its header, payload and claims — decoded locally, never sent anywhere.
Header
Payload
Claims
Decoded locally, not verified: a JWT’s header and payload are just Base64URL-encoded JSON, so anyone can read them — never put secrets in a token. This tool decodes the token in your browser; it does not check the signature, which needs the issuer’s secret or public key.
About the JWT Decoder
The JWT Decoder splits a JSON Web Token into its header, payload and signature and shows the claims in readable form, with issued-at and expiry times converted to real dates. It is useful for debugging logins, checking which claims an API receives and seeing whether a token has expired. Decoding happens locally, so tokens are not sent to any server.
How to use the JWT Decoder
- Paste the encoded token.
- Read the decoded header, including the signing algorithm.
- Read the payload and its claims.
- Check the issued-at and expiry dates to see whether the token is still valid.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, signed token made of three Base64URL parts separated by dots: a header, a payload of claims and a signature. It is widely used for login sessions and API authorisation.
Does decoding a JWT verify it?
No. Anyone can decode the header and payload because they are only encoded, not encrypted. Verifying the signature requires the secret or public key, which should happen on your server.
Is it safe to paste a token here?
Decoding runs entirely in your browser and nothing is uploaded. Even so, treat live production tokens like passwords and avoid sharing them.