JWT Decoder

Paste a JWT to decode its header, payload, and signature instantly. Runs locally in your browser - nothing is uploaded.

JWT

Paste a JWT to decode it.

Header

—

Payload

—

Signature

—
This tool only decodes the token - it does not verify the signature. Never paste a real production token into a third-party website; use example or test tokens when checking a tool like this.

exp / iat / nbf

No exp/iat/nbf claims found in the payload.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token made of three base64url-encoded parts separated by dots: header.payload.signature. The header names the algorithm, the payload carries claims (like user id, roles, or expiry), and the signature lets a server verify the token was not tampered with - but the header and payload are only encoded, not encrypted, so anyone can read them without the secret key.

FAQ

Is my JWT uploaded anywhere?

No. Decoding happens entirely in your browser using JavaScript. The token text never leaves your device or gets sent to a server.

Does this tool verify the JWT signature?

No, this is a decoder only. It reveals the header and payload content but does not check the signature against a secret or public key, so a decoded token being readable does not mean it is valid or untampered.

Why can anyone read my JWT payload?

JWT header and payload are base64url-encoded, not encrypted. Encoding is reversible by design, so never put secrets or sensitive data directly in a JWT payload.

What do the exp, iat, and nbf claims mean?

They are standard JWT timestamp claims: iat is when the token was issued, exp is when it expires, and nbf means the token is not valid before that time. All three are Unix timestamps in seconds.

Related tools

Base64 / URL Encode·Decode · JSON Formatter · Hash Generator · Unix Timestamp Converter