JWT Decoder
Paste a JSON Web Token to decode its header and payload. This does not verify the signature.
Last updated
🔒 What you type here never leaves this device. It all happens in your browser, which is told to block this page from sending anything to other websites. Try it with airplane mode on: it still works. Check for yourself
Sent to other websites from this page: 0
How to decode a JWT
- Paste the token (it starts with eyJ).
- Click Decode to see the header and payload as JSON, with dates shown in readable form.
- Use Copy beside each part to copy it.
About this tool
A JWT is three Base64URL-encoded segments — header, payload, and signature — separated by dots. This tool splits the token, decodes the header and payload as JSON, and formats them for reading; the signature segment is shown as-is, in raw Base64URL. Standard timestamp claims (iat, exp, nbf) are annotated with their human-readable date so you don't have to convert them by hand.
This tool does not verify the signature — decoding a JWT tells you what it claims, not whether it's authentic. Anyone can construct a token with an arbitrary header and payload; only checking the signature against the issuer's real secret or public key (something this browser-only tool has no way to know) proves a token hasn't been tampered with. Never trust a decoded JWT's contents for anything security-sensitive without verifying it server-side first. Nothing you paste here is sent to a server — the entire tool runs as JavaScript in your browser tab.
Questions about JSON Web Tokens
What is a JWT?
A JSON Web Token: three Base64URL parts (header, payload and signature) joined by dots, used to pass login and permission details between systems.
Does this check the signature?
No. Decoding shows what a token claims, not whether it’s genuine. Only the server with the right key can verify it, so never trust a decoded token on its own.
What do iat, exp and nbf mean?
Issued at, expires at and not before, as Unix timestamps. Their readable dates are shown next to them, so you can see if a token has expired.
Is it safe to paste a token here?
It’s decoded in your browser and never sent anywhere. Even so, treat live tokens like passwords and avoid sharing them.