JWT Decoder
Decode a JSON Web Token's header and payload in your browser. Nothing is uploaded.
Decoding only — the signature is not verified. Nothing is uploaded.
A JSON Web Token packs a header and payload into a compact, Base64URL-encoded string. JWT Decoder splits it apart and shows the readable header and payload in your browser — so you can inspect claims like expiry and subject while debugging, without your token ever leaving your device.
How to use jwt decoder
- 1. Paste your JWT.
- 2. Its header and payload are decoded and displayed.
- 3. Read the claims (issuer, subject, expiry and more).
When to use JWT Decoder
Debug authentication
See what claims a token carries when troubleshooting a login or API call.
Check expiry
Read the exp claim to confirm whether a token is still valid.
Inspect a payload
View the subject, roles or custom claims encoded in a token.
Decoding is not verifying
This shows what's inside a JWT, but it doesn't check the signature — anyone can read a token's payload. Never trust a decoded token as proof of anything on the client; the signature must be verified server-side with the secret or key. And because tokens are sensitive, it matters that this decoder runs entirely in your browser.
Frequently asked questions
Does it verify the token's signature?
No — it only decodes the header and payload for inspection. Signature verification must happen on the server with the key.
Is it safe to paste a real token here?
The decoding runs entirely in your browser and the token isn't uploaded, but treat any live token carefully regardless.
Why is the payload readable without a password?
A JWT payload is only Base64URL-encoded, not encrypted — its security comes from the signature, not secrecy.