JWT Decoder
Paste a JWT to see its decoded header and payload. This tool decodes only — it does not verify the signature.
—
—
How to use the JWT Decoder
- Paste a JWT (the three dot-separated parts).
- The decoded header and payload appear automatically.
- Check the expiration (exp) and issued-at (iat) fields if present — they're shown as both raw numbers and readable dates.
How it works
A JWT has three parts separated by dots: header.payload.signature. The header and payload are each Base64URL-encoded JSON, which is why they can be decoded by anyone without a secret key — decoding is not the same as verifying. The signature is what actually proves a token wasn't tampered with, and checking it requires the issuer's secret or public key, which this tool deliberately does not do.
Frequently asked questions
Does this verify the token's signature?
No. This tool only decodes the header and payload, which is possible without any key. A decoded token is NOT proof that it's authentic or unmodified — verifying the signature requires the issuer's secret (HMAC) or public key (RSA/EC), checked server-side.
Is my token sent to a server?
No — decoding happens entirely in your browser using Base64URL decoding and JSON.parse(). That said, treat tokens like passwords: don't paste a live production token into any website, including this one, since anyone who has the raw token string can use it until it expires.