JWT Decoder

Decode and inspect JWT tokens

About JWT Decoder

JWT Decoder splits a JWT into its header and payload, base64url-decodes each, and pretty-prints the resulting JSON, entirely in your browser — nothing is uploaded to a server. It decodes only: it does not verify the signature, so it cannot tell you whether a token is authentic or has been tampered with. Any string with the correct three-part, base64url-encoded-JSON shape will decode successfully, valid signature or not.

How to use JWT Decoder

  1. 1Paste a JWT into the input box (three base64url segments separated by dots).
  2. 2Click 'Decode' to view the header and payload as formatted JSON.
  3. 3Read the claims — common ones include exp (expiration), iat (issued at), and sub (subject).
  4. 4If the format is invalid, you'll see an 'Invalid JWT token' error.

Frequently Asked Questions

What is a JWT?

A compact, URL-safe token format with three dot-separated parts — header, payload, and signature — commonly used to carry authentication claims.

Does this tool verify the signature?

No. It only decodes the header and payload; the signature segment isn't checked or even displayed. A forged or tampered token with the right shape will decode exactly like a genuine one.

Is my token uploaded to a server?

No, decoding happens entirely in your browser.

Can I use this to confirm a token is valid or trustworthy?

No — decoding is not validation. To actually verify a token, check its signature against the issuer's key using a JWT library on a server or trusted environment, not by eye in a decoder like this.

Tips & Tricks

  • Never treat a successfully decoded token as proof of authenticity — decoding always succeeds regardless of whether the signature is valid.
  • Check the exp claim to see when a token expires, but remember this is just reading a field, not confirming the token wasn't forged.
  • Useful for quickly inspecting claims during development, not for making trust decisions about a token's origin.
  • Be cautious pasting real production tokens here or anywhere — anyone who has the token text can read its (unencrypted) payload.