How JWT Decoder Works
A JWT is three Base64URL-encoded parts separated by dots: a header, a payload and a signature. The header and payload are just JSON — this tool decodes them so you can read the claims inside. The signature can't be verified without the secret or private key it was signed with, so it's shown as-is without a validity check.
How to Use This Tool
- Paste a JWT into the input box.
- Select Decode.
- Read the decoded header and payload as formatted JSON.
Example
The token eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc decodes to a header of {"alg":"HS256"} and a payload of {"sub":"1234567890"}.
Helpful Tips
- The payload often contains an
expclaim (expiry, as a Unix timestamp) — paste it into the Timestamp Converter to see it as a readable date. - Never paste a production token with sensitive claims into a tool you don't trust — this one only processes it locally, but it's a good habit to check regardless.
Frequently Asked Questions
Can this tool verify whether a token is valid?
No. Verifying a signature requires the secret or public key the token was signed with, which this tool never asks for or has access to — it only decodes the readable parts.
Why does the payload sometimes look unreadable?
If the input isn't a well-formed JWT (wrong number of segments, or a segment that isn't valid Base64URL-encoded JSON), decoding will show a clear error instead of garbled text.
Is my token uploaded anywhere?
No, decoding happens entirely in your browser — the token never leaves your device.
This tool runs entirely in your browser. Your input is not uploaded to any server.