JWT decoder
Decode a JSON Web Token to read its header and claims. The token never leaves your browser.
Runs 100% in your browser Header
Payload
How to decode a JWT
- Paste your token. Paste the full JWT (header.payload.signature) into the box.
- Read the claims. The header and payload are decoded and pretty-printed; standard time claims are shown as dates.
About JSON Web Tokens
JWTs encode a set of claims that a server can issue and later trust because they are signed. The
header names the signing algorithm; the payload carries claims like sub, exp
and any custom data. Because the payload is only Base64URL-encoded — not encrypted — anyone can read
it, so never put secrets in a JWT. Decoding here is purely local, which matters: a token is a
credential, and this page never transmits it.
Frequently asked questions
- A JSON Web Token is a compact, signed token with three Base64URL parts separated by dots: a header, a payload of claims, and a signature. It is widely used for authentication and stateless sessions.
- No. This tool decodes the header and payload so you can read the claims. It does not verify the signature, which would require the secret or public key. Never trust a token's contents without verifying it on your server.
- Yes — decoding happens entirely in your browser and the token is never sent anywhere. Still, treat real tokens as secrets and avoid pasting production credentials into any online tool you don't control.
exp(expiration) andiat(issued-at) are Unix timestamps. This decoder shows them as human-readable dates and flags an expired token.