JWT Decoder
Inspect a token's header and payload.
Runs entirely in your browser — nothing you enter is uploaded or sent to a server.
This only reads a token's claims — it does not check the signature, so a decoded token is no proof that it's genuine or unexpired. Avoid pasting live production tokens here, just as a precaution. Read our full disclaimer.
About this tool
A JWT (JSON Web Token) has three Base64URL parts — header, payload, and signature — separated by dots. This tool decodes the header and payload so you can read the claims inside: who issued the token, who it's for, when it expires, and any custom data. It does not verify the signature — that requires the signing key and belongs on a server — so it's purely for inspection and debugging, and it all runs in your browser.
Note
Decoding shows what's inside a token but does not prove it's valid — signature verification needs the secret/public key.
How to use
- 1Paste a JWT (header.payload.signature).
- 2Read the decoded header and payload as formatted JSON.
- 3Use the sample token to see how it works.
Features
- Decodes the header and payload into readable JSON.
- Handles Base64URL and missing padding.
- Clear message when a token is malformed.
Frequently asked questions
Does this verify the token's signature?
No. Verification requires the signing key and should happen on a server. This tool only decodes the header and payload for inspection.
What do the standard JWT claims mean?
Common payload claims are iss (issuer), sub (subject/user), aud (audience), exp (expiry), iat (issued-at), and nbf (not-before). The exp, iat, and nbf values are Unix timestamps — our Epoch Converter turns those into readable dates.
Can everyone read what's inside a JWT?
Yes — the header and payload are only encoded (Base64URL), not encrypted, so anyone with the token can decode them, as this tool does. Never put secrets in a JWT payload; the signature protects against tampering, not against reading.
Why is my token in three parts separated by dots?
A JWT is header.payload.signature. The header and payload are Base64URL-encoded JSON (which this tool decodes); the signature is a cryptographic check computed over the first two parts, used to confirm the token wasn't altered.
Is it safe to paste a token here?
Decoding happens entirely in your browser — nothing is sent anywhere. Still, avoid pasting production tokens that are currently valid, as a precaution.
More developer tools
View allURL Encoder / Decoder
Encode text so it's safe to drop into a URL, or decode percent-encoded text back to readable form — instantly and entirely in your browser, nothing uploaded.
Open toolColor Converter
Convert a color between HEX, RGB, and HSL, with a live swatch preview and one-click copy — paste any of the three formats.
Open toolText Diff
Compare two blocks of text line by line and see exactly what was added, removed, or left unchanged — a quick side-by-side diff that runs in your browser.
Open tool