JWT Decoder
Decode and inspect JWT header and payload.
This tool runs entirely in your browser. Your data never leaves your device — nothing is uploaded to our servers.
About JWT Decoder
A JSON Web Token is three Base64url segments separated by dots: header, payload, and signature. The first two are merely encoded, so anyone holding the token can read its claims — which is exactly why you must never put secrets in a JWT payload. This decoder splits the token and renders the header and payload locally, so you can check the expiry, issuer and audience claims while debugging an auth flow.
When to use JWT Decoder
Working out why a request returns 401
Decode the token and check exp against the current time. An expired token, or a clock skew between services, explains a surprising share of auth bugs.
Verifying claims during integration
Confirm that iss, aud and scope hold what the receiving service expects before blaming its configuration.
Confirming nothing sensitive is being leaked
Because payloads are readable by anyone, decoding your own tokens is a quick audit that no personal data or internal identifiers are being exposed.
Limitations worth knowing
- This decodes but does not VERIFY. A valid-looking payload proves nothing about authenticity without checking the signature against the signing key.
- Signature verification requires the secret or public key and must happen server-side; never ship a signing secret to a browser.
- Encrypted tokens (JWE, five segments) are not supported — only signed tokens (JWS, three segments).
- Timestamps are seconds since epoch, not milliseconds; multiplying by 1000 is the usual conversion mistake.
How to jwt decoder
- 1
Paste the full token, including all three dot-separated segments.
- 2
Read the decoded header to see the signing algorithm.
- 3
Read the payload claims — check exp (expiry) and iat (issued at), both Unix timestamps in seconds.
- 4
Compare the claims against what the receiving service expects.
Frequently asked questions
Does decoding a JWT mean it's valid?+
No, and conflating the two is a genuine security bug. Decoding only reverses Base64url — anyone can do it to any token. Validity requires verifying the signature with the issuer's key, plus checking expiry, issuer and audience. Never trust a token's claims because they decoded cleanly.
Is it safe to paste a token here?+
Decoding happens entirely in your browser, so the token isn't transmitted. That said, treat any live token as a credential: if it's an active session token, prefer an expired or test token when possible, and rotate anything you've pasted into a tool you don't control.
Why can I read the payload? Isn't that insecure?+
It's by design. JWTs are signed, not encrypted — the signature guarantees the claims haven't been tampered with, not that they're hidden. This is precisely why passwords, keys and sensitive personal data must never be placed in a JWT payload.
Related developer tools
JSON Formatter
Beautify, minify and validate JSON.
JSON Minifier
Compress JSON to a single line, or beautify it back.
HTML Entity Encoder
Escape special characters into safe HTML entities.
HTML Entity Decoder
Convert HTML entities back into plain characters.