JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe way to carry a set of claims between two parties, used most often for authentication and authorization. It has three parts separated by dots: a header describing the signing algorithm, a payload holding the claims (such as the subject, issued-at, and expiry times), and a signature that lets the receiver verify the token was not tampered with. The header and payload are just Base64url-encoded JSON, so they are readable by anyone — only the signature requires a secret or key. This tool splits the token, decodes the header and payload, and pretty-prints them so you can inspect exactly what a token contains while debugging an auth flow.

Decoding happens entirely in your browser — the token you paste is never sent to a server, logged, or stored, and there is no account or tracking. That makes it safe for inspecting test and development tokens. That said, a JWT often grants access while it is valid, so treat any real token like a password: avoid pasting a live production token into any website, including this one, and never share the secret used to sign tokens. The header and payload carry no secret, but the token as a whole can be replayed until it expires, so use expired or test tokens when you just need to see the structure.

Verifying a JWT's signature requires the signing secret (for HMAC algorithms like HS256) or the issuer's public key (for RSA/ECDSA like RS256). This tool is a decoder, not a verifier: it deliberately does not ask for your secret or key, so it cannot and does not confirm whether a token is authentic or untampered — it only shows you what the header and payload contain. Never trust a decoded payload for a security decision without verifying the signature in your backend with the proper key. Use this tool to inspect and debug token contents; do the actual verification in your server code or a trusted library.

These are standard registered claims expressed as Unix timestamps (seconds since 1970). iat is 'issued at', the time the token was created; exp is 'expiration', after which the token must be rejected; and nbf is 'not before', a time before which the token is not yet valid. This tool converts each of these to a readable date and tells you whether the token is currently expired, valid, or not yet active by comparing them to your device's clock. Note the comparison uses your local time, so a token that looks expired here could differ slightly from a server with clock skew — backends usually allow a small leeway when validating these claims.

By default, no. A standard signed JWT (JWS) is only Base64url-encoded, not encrypted, so its header and payload are fully readable by anyone who holds the token — which is exactly why this tool can decode it without any key. The signature protects integrity, not confidentiality: it stops tampering but does not hide the contents. For that reason you should never put secrets, passwords, or sensitive personal data inside a JWT payload. If contents truly must be hidden, a separate standard called JWE (JSON Web Encryption) encrypts the token, but it is far less common and is not what most 'JWT' tokens use.