JWT Decoder
Paste a JSON Web Token to inspect its header and payload claims. Decoding happens locally — your token never leaves the browser.
About this tool
The JWT Decoder splits a JSON Web Token into its three parts and shows the decoded header and payload as readable JSON. A JWT is a compact, dot-separated string — header.payload.signature — whose header and payload are Base64URL-encoded, not encrypted, so their claims can be inspected without any secret key.
Developers use it to check claims like iss, sub, exp and iat while debugging authentication, verifying token contents or exploring an API's login flow. Decoding runs entirely in your browser, so a token that may grant access to your account is never sent to a server.
How to use
- Paste your full JWT (the header.payload.signature string) into the input box.
- Read the decoded header to see the signing algorithm and token type.
- Read the decoded payload to inspect the claims carried by the token.
- Check human-readable timestamps for issued-at (iat) and expiry (exp) claims.
- Copy any decoded section to use elsewhere while debugging.
Features
- Decodes and pretty-prints the JWT header and payload.
- Highlights standard claims such as iss, sub, aud, exp and iat.
- Converts numeric timestamps into readable dates.
- Syntax-highlighted JSON output for easy scanning.
- Clear error messages for malformed tokens.
- Fully client-side — your token never leaves the browser.
Frequently asked questions
Does my token get sent to a server?
No. The token is decoded locally in your browser and never transmitted. This matters because a valid JWT can grant access to an account.
Does this verify the token's signature?
No. This tool decodes the header and payload so you can read the claims, but it does not verify the cryptographic signature. Never trust a token's contents without server-side verification.
Is the payload of a JWT encrypted?
No. A standard signed JWT is only Base64URL-encoded, not encrypted, so anyone can read the payload. Never put secrets in a JWT payload.
How do I read the exp and iat claims?
They are Unix timestamps in seconds. The decoder converts them into readable dates so you can quickly see when a token was issued and when it expires.
Why does my token fail to decode?
A JWT must have three Base64URL parts separated by dots. Decoding fails if a part is missing, truncated, or contains invalid characters — check that you copied the whole token.