JWT Decoder
Decode a JWT header and payload in your browser. The token is never sent anywhere—everything is processed on your device. Does not verify the signature.
No upload, no data sent — everything runs in your browser.
About this tool
A JWT (JSON Web Token) is a token format for carrying information such as login state and permissions. It has three parts separated by dots (.): "header.payload.signature." This tool decodes and displays a JWT's contents in your browser and never sends the token anywhere.
What the three parts do
- Header — metadata such as the signing algorithm (e.g. HS256, RS256).
- Payload — the actual data (claims): user ID, expiry, and so on.
- Signature — used to verify the token has not been tampered with; made with a secret/public key.
"Decode" is not "verify"
This tool only decodes (reads) the contents; it does not verify the signature. The header and payload are merely Base64 (URL-safe) encoded, so anyone can read them without a key. To confirm a token is genuine (untampered), the server must verify the signature. Being able to decode a token does not mean it is valid or legitimate.
Never put secrets inside
Since the payload is readable by anyone, never put secrets like passwords or card numbers in a JWT. Think of a JWT as "signed public data," not encryption. If you need to hide the contents, you need a separate encryption mechanism.
Common claims
- exp — expiry (Unix time). Tokens past this are treated as invalid.
- iat — issued-at time.
- sub — the token's subject (often the user ID).
- iss / aud — the issuer and the intended audience.
How to use
- Paste a JWT (header.payload.signature) into the input field.
- The header and payload are decoded and shown.
- Use “Copy” to copy the content.
FAQ
Is the token sent to a server?
No. Decoding happens entirely in your browser; the JWT you enter is never sent anywhere.
Is decoding the same as verifying the signature?
No. This tool only decodes to read the contents; it does not verify the signature, which requires the issuer’s secret or public key.
Is the JWT content encrypted?
No. The payload is only Base64URL-encoded, not encrypted. Anyone can decode it, so never put secrets inside.
Where do I find the expiry?
The payload’s exp claim (UNIX time) is the expiry, and iat is the issued-at time. Convert the numeric times to dates to read them.
Can I read the signature part?
The signature is binary computed from the algorithm and key, then Base64URL-encoded — not human-readable. It exists to detect tampering.
When would I use this?
Debugging API authentication, checking token expiry and claims, and confirming a token contains what you expect.