JWT Decoder
Paste a JWT to decode its header and payload into readable JSON and inspect standard claims like exp, iat, and iss. Decoding happens entirely in your browser — the token is never sent anywhere.
About JWT Decoder
A JSON Web Token (JWT) is three Base64url-encoded parts — header, payload, and signature — joined by dots. The header and payload are not encrypted, just encoded, so they can be read by anyone. This decoder splits the token, decodes the header and payload to formatted JSON, and surfaces standard claims like expiry (exp) and issued-at (iat). It never verifies or needs your signing secret, and the token stays in your browser.
Frequently asked questions
Is it safe to paste my token here?+
Decoding runs entirely client-side — the token isn't transmitted. That said, treat any live token as a credential; decode expired or test tokens when you can.
Does this verify the signature?+
No. Verifying requires the signing secret or public key and should happen on your server. This tool only decodes the readable header and payload.
Why can everyone read my JWT payload?+
JWTs are signed, not encrypted. The signature proves the token wasn't tampered with, but the payload is only Base64url-encoded — never put secrets in it.