A JSON Web Token looks like a random blob, but most of it is just readable data in disguise. Decoding one is useful for debugging logins and API calls — as long as you understand what decoding does and doesn't prove.
How to decode one
- Paste the token into JWT Decoder.
- Its header and payload are decoded and shown.
- Read the claims — issuer, subject, expiry (
exp), roles and any custom fields.
Because the tool runs in your browser, the token isn't uploaded anywhere.
Why it's readable without a password
A JWT has three parts: header, payload and signature. The header and payload are only Base64URL-encoded, not encrypted — that's why anyone can read them. The security comes entirely from the signature, which is created with a secret only the server knows.
The trap to avoid
Decoding a token proves nothing about whether it's valid. Anyone can craft a token with any claims they like; only verifying the signature on the server with the key confirms it's genuine. So never trust a decoded token on the client to make a security decision — use it for inspection and debugging only.
To check a value's integrity instead, generate a SHA hash.