About this tool
A JWT (JSON Web Token) is a compact, signed token used for authentication in modern web apps. This decoder splits the token and shows its header and payload as readable JSON, so you can inspect claims like the user, expiry and issuer. Decoding happens entirely in your browser — your token is never sent anywhere.
How to use
- 1Paste your JWT.
- 2The header and payload decode instantly.
- 3Inspect the claims.
Benefits
- Shows header and payload.
- Runs locally — private.
- Readable JSON output.
Decoding a JWT does not verify its authenticity
Practical example
Anyone holding a token can Base64-decode its header and payload. Only signature verification with the expected algorithm, issuer, audience and trusted key establishes whether a system should accept it.
Interpreting the result
Inspect claims such as exp, nbf, iss and aud as debugging clues. Convert numeric dates carefully and compare them with server time, while keeping authorization decisions inside the verified application.
Limits and common mistakes
JWT payloads are encoded, not encrypted, and may contain sensitive data. Never paste live credentials into an untrusted service or treat decoded claims as verified permissions.
Detailed guides for this tool
Learn the underlying concepts, worked examples and common mistakes before relying on the result.
Frequently asked questions
Does it verify the signature?+
No. It decodes the readable parts; signature verification needs the secret key and a backend.
Is it safe to paste a real token?+
Decoding is local, but avoid sharing production tokens publicly.