What Is a JWT?
The JWT Decoder reveals what is inside a JSON Web Token without sending it anywhere. Paste a token and the tool splits it into its three parts, Base64URL-decodes the header and payload, and pretty-prints both as JSON. It automatically interprets the standard time claims — issued-at (iat), not-before (nbf) and expiry (exp) — as human-readable dates and warns you clearly when a token has expired. Remember that a JWT payload is only encoded, not encrypted, so anyone can read it; this tool never verifies the signature and runs entirely in your browser, so your tokens stay on your device.
A JSON Web Token (JWT) is a compact, URL-safe string used to represent claims between two parties. It consists of three Base64URL-encoded sections separated by dots: a Header (algorithm and token type), a Payload (claims such as user ID, expiry time and roles) and a Signature (used to verify the token has not been tampered with). JWTs are the most common authentication token format in modern web APIs and single-page applications.
How to Use the JWT Decoder
- Paste a JWT (header.payload.signature) into the input box.
- Read the decoded header and payload, formatted as JSON.
- Check the expiry status and the human-readable iat/nbf/exp dates.
Use Cases
- Inspecting what claims a token carries — user ID, email, expiry, roles — without needing a server.
- Debugging authentication issues by checking whether a token has expired or carries the wrong claims.
- Understanding the algorithm in the header (HS256, RS256, etc.) to know how the token is signed.
- Learning how JWT structure works as a developer or security engineer.
How JWT Decoding Works
Decoding a JWT is straightforward: the tool splits the token on dots, Base64URL-decodes each of the three parts and parses the resulting JSON. Base64URL is a variant of Base64 that replaces + with - and / with _, and omits = padding, making tokens safe for use in URLs and HTTP headers.
Decoding is not the same as verifying. This tool can read the claims in any JWT without the signing key — just as any recipient can read the payload of a JWT. Verification (checking the signature against the server's secret or public key) requires the key and must be done server-side. Never rely on a decoded JWT as proof of authenticity without signature verification.
Benefits and Use Cases
- Quickly inspect token claims and expiry while debugging authentication.
- Understand exactly what data an app stores in its tokens.
- Decodes locally in your browser — your token is never sent to a server.
Privacy
Decoding happens entirely in your browser. Tokens — which often contain sensitive identity information — are never sent to our servers. If you are debugging a production token, it is safe to paste it here.