JWT Decoder

Decode JWT header and payload from base64url and inspect claims without verifying the signature.

For this tool, processing runs locally in your browser and data is not sent to the server.

JWT Decoder is a free online tool that decodes a JSON Web Token header and payload from base64url and displays them as readable JSON. It shows key claims such as exp, iat, and nbf as human-readable dates. The tool runs in your browser and does not send data to the server. Note: signature is not verified, so this tool cannot confirm trust in the token.

What it does

Output

Processing

Continue working

Choose a related tool for the next step.

Data passed between tools is kept only in the current browser session.

How to use

Paste a JWT token in header.payload.signature format.
Click Decode to see the header and payload as readable JSON.
Check claims: alg, typ, iss, sub, aud, iat, exp, nbf, and other fields.
Keep in mind that the signature is not verified: decoding does not confirm the token is trustworthy.

More about this tool

JWT Decoder displays the contents of a JSON Web Token in a readable form. The tool decodes the header and payload from base64url, formats the JSON, shows the signature as a separate part, and displays key claims: alg, typ, kid, iss, sub, aud, iat, exp, nbf, and jti. This is useful for debugging APIs, authorization flows, OAuth, OpenID Connect, webhooks, and backend integrations.

The exp, iat, and nbf timestamp claims are converted to human-readable dates so you can instantly see whether the token has expired. The signature is not verified, so this tool cannot be used to confirm that a token is genuine.

All processing is done locally in the browser. Your token is not sent to the server.

Runs in the browser
Data is not sent to the server
Decodes JWT header and payload
Shows JSON in a readable format
Displays key claims
Shows exp, iat, and nbf as human-readable dates
Useful for debugging APIs, OAuth, and auth flows
No registration required

Frequently Asked Questions

What does the JWT Decoder do?

It decodes the header and payload of a JWT from base64url and displays them as readable JSON. The signature is shown separately but is not verified.

Does the tool verify the JWT signature?

No. This service only decodes the JWT. It does not verify the signature and cannot confirm that the token is trustworthy.

Can I use the decoder to check token security?

No. Decoding reveals the token's contents but does not prove its authenticity. Verifying authenticity requires a separate signature check with the secret or public key.

What is the JWT header?

The header contains metadata about the token, such as the algorithm (alg), type (typ), and sometimes a key ID (kid).

What is the JWT payload?

The payload contains claims — the token's data, such as iss, sub, aud, iat, exp, nbf, and custom fields. The payload is typically not encrypted and can be read by anyone with the token.

What does exp mean in a JWT?

exp is the Unix timestamp for the token's expiry. The decoder can display it as a regular date and indicate whether the token has already expired.

Is it safe to paste a JWT into an online decoder?

The tool processes data locally in the browser and does not send it to the server. Even so, avoid pasting production access tokens, refresh tokens, secrets, or personal data.

Why is the JWT payload visible without a password?

A JWT is typically signed, not encrypted. Base64url is an encoding scheme, not a protection mechanism. The payload can therefore be read without a key.

Is my data sent to the server?

No. The JWT is processed locally in the browser and is not sent to the server.

Do I need to register?

No. The tool works immediately without registration.

More about this tool

All processing is done locally in the browser. Your token is not sent to the server.

Runs in the browser
Data is not sent to the server
Decodes JWT header and payload
Shows JSON in a readable format
Displays key claims
Shows exp, iat, and nbf as human-readable dates
Useful for debugging APIs, OAuth, and auth flows
No registration required

Frequently Asked Questions

What does the JWT Decoder do?

It decodes the header and payload of a JWT from base64url and displays them as readable JSON. The signature is shown separately but is not verified.

Does the tool verify the JWT signature?

No. This service only decodes the JWT. It does not verify the signature and cannot confirm that the token is trustworthy.

Can I use the decoder to check token security?

No. Decoding reveals the token's contents but does not prove its authenticity. Verifying authenticity requires a separate signature check with the secret or public key.

What is the JWT header?

The header contains metadata about the token, such as the algorithm (alg), type (typ), and sometimes a key ID (kid).

What is the JWT payload?

The payload contains claims — the token's data, such as iss, sub, aud, iat, exp, nbf, and custom fields. The payload is typically not encrypted and can be read by anyone with the token.

What does exp mean in a JWT?

exp is the Unix timestamp for the token's expiry. The decoder can display it as a regular date and indicate whether the token has already expired.

Is it safe to paste a JWT into an online decoder?

The tool processes data locally in the browser and does not send it to the server. Even so, avoid pasting production access tokens, refresh tokens, secrets, or personal data.

Why is the JWT payload visible without a password?

A JWT is typically signed, not encrypted. Base64url is an encoding scheme, not a protection mechanism. The payload can therefore be read without a key.

Is my data sent to the server?

No. The JWT is processed locally in the browser and is not sent to the server.

Do I need to register?

No. The tool works immediately without registration.