JWT Decoder — Inspect JSON Web Token Header & Payload
Paste a JWT to read its header and payload as JSON, and see when it expires — decoded locally, with no signature verification and nothing uploaded.
—
What this tool does
It takes a JSON Web Token and shows you what is actually inside it. The three dot-separated
segments are a header, a payload and a signature; the first two are only base64url-encoded, so they
can be read back as JSON without any key. The tool decodes both, pretty-prints them, and turns the
registered time claims — exp, iat and nbf — into readable
UTC so you can see whether the token is currently valid.
What it deliberately does not do
It does not verify the signature. Decoding proves nothing about authenticity: the payload of a forged token would look exactly as convincing. Signature verification requires the HMAC secret or the issuer’s public key and belongs on a trusted server. Use this tool to inspect a token while debugging — to check a claim, an audience or an expiry — never to decide whether to grant access.
The three parts
| Segment | Contents | Secret? |
|---|---|---|
| Header | Signing algorithm (alg) and type (typ) | No — public |
| Payload | The claims: sub, exp, iat, custom fields… | No — public, not encrypted |
| Signature | MAC or signature over the first two segments | Depends on the key |
Because the payload is public, never place secrets in a JWT. Anyone can read it; this page just makes that fact obvious.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, URL-safe string that carries claims about a subject. It has three base64url segments separated by dots: a header (the signing algorithm and token type), a payload (the claims), and a signature. This tool shows you the header and payload in readable JSON.
Does this tool verify the signature?
No, and it cannot. Decoding only base64url-decodes the first two segments; it proves nothing about who issued the token or whether it was tampered with. A token shown here as valid-looking may be forged. Verification needs the signing key or public key and must happen on a trusted server — never trust a client-side “decoded” token for access decisions.
Is it safe to paste a token here?
The token is decoded entirely in your browser and never uploaded, so it does not leave your device. Treat it carefully anyway: a JWT is a bearer credential, and anyone who has it can use it until it expires. Avoid pasting production tokens into any online page you do not control, including this one, if you can decode them locally instead.
What do exp, iat and nbf mean?
exp is the expiry time, iat the issued-at time and nbf the not-before time, all as Unix timestamps in seconds. The tool converts them to readable UTC and tells you whether the token is currently within its validity window — which, again, is not a substitute for server-side signature checking.
Why does the payload sometimes look like gibberish?
The payload is only base64url-encoded, not encrypted, so it is readable to anyone. If the header says JWE or the segments are five instead of three, the token is encrypted or is not a JWT in the usual three-part form, and this decoder will report that rather than guess.
What are the three parts again?
Header, payload, signature — joined by dots as header.payload.signature. Everything before the last dot is public; only the signature depends on a secret. That is why you must never put secrets in a JWT payload.
Go deeper
Longer explanations of the problems this tool solves:
Sources
- RFC 7519, JSON Web Token (JWT). rfc-editor.org/rfc/rfc7519
- RFC 4648, The Base16, Base32, and Base64 Data Encodings (base64url).
Everything runs in your browser — nothing you type is uploaded.