JWT Decoder
Paste a JSON Web Token to decode its header and payload. Signature is not verified — see why in the FAQ below.
—
—
How to use it
- Paste a full JWT (three Base64url segments separated by dots) into the box.
- Click Decode Token.
- The header and payload appear as formatted JSON side by side.
- If the token includes
exp,iat, ornbf, a strip above the results shows them as readable dates, including whether the token has expired.
What's actually happening
A JWT has the shape header.payload.signature. The header and payload are each JSON objects that were Base64url-encoded — the URL-safe variant of Base64 that uses - and _ instead of + and /, and typically omits the = padding. This tool splits the token on its dots, restores standard Base64 characters and padding for each of the first two segments, decodes them as UTF-8 bytes, and parses the result as JSON.
The third segment — the signature — is deliberately left alone. It's a cryptographic value (HMAC or a digital signature, depending on the header's alg) computed over the header and payload using a secret or private key the issuer holds. Verifying it would require that key, which should never be pasted into any tool. Decoding only reveals what was never hidden in the first place.
Worked example
Decoding eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFkYSIsImlhdCI6MTcxNjIzOTAyMn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U (try it in the box above) produces:
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234",
"name": "Ada",
"iat": 1716239022
}The tool also converts iat: 1716239022 into a readable date automatically, since raw Unix timestamps aren't meant for humans to read directly.
Reference: standard JWT claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who issued the token |
sub | Subject | Who the token is about (usually a user ID) |
aud | Audience | Who the token is intended for |
exp | Expiration | Unix timestamp after which the token is invalid |
nbf | Not before | Unix timestamp before which the token isn't valid yet |
iat | Issued at | Unix timestamp when the token was created |
Frequently asked questions
Does this tool verify the JWT's signature?
No, and no browser-side tool honestly can for a securely-issued token. Verifying requires the issuer's secret or public key, which you should never paste into a third-party site. This tool only decodes the header and payload, readable without any key.
Why can I read the payload without a secret key?
Because a JWT's header and payload are only Base64url-encoded, not encrypted. Encoding is reversible by anyone, no key required. Never put sensitive information like passwords directly in a JWT payload.
What do the "exp", "iat", and "nbf" claims mean?
Standard registered claims holding Unix timestamps. "iat" is issued-at. "exp" is expiration — the token should be rejected after this time. "nbf" is not-before. This tool converts all three to human-readable dates automatically.
Why does my JWT show three parts separated by dots?
A JWT is always header.payload.signature. The header describes the token type and algorithm, the payload holds the claims, and the signature detects tampering.
Is it safe to paste a real production JWT into this tool?
Decoding happens entirely in your browser — the token is never sent to a server. Still, treat any tool you paste tokens into with caution, and prefer decoding locally in your own dev tools when a token is highly sensitive.