JWT Decoder
Paste a JWT to see its header and payload. Decoding happens locally — this tool never verifies a signature against a secret, because doing that safely would require either shipping your secret to the browser or sending your token to a server. Neither happens here.
Header
Payload
What this tool does and doesn't do
A JWT's header and payload are Base64URL-encoded, not encrypted — anyone holding the token can already read them, so decoding them locally loses nothing over decoding them on a remote server. The difference is that a remote decoder can log every token it ever receives, including yours.
This tool intentionally stops at decoding. It does not check the signature, because a trustworthy signature check needs your service's real secret or public key, and that key should never leave your own infrastructure.
JWT structure, in short
A JWT is three Base64URL segments joined by dots:
header.payload.signature. The header
usually carries alg (the signing
algorithm, e.g. HS256 or
RS256) and
typ. The payload holds whatever claims the
issuer put there — commonly the registered ones:
iss (issuer),
sub (subject),
aud (audience),
exp (expiry),
nbf (not-before), and
iat (issued-at) — plus any custom claims
the service adds.
Because none of that is encrypted, a JWT should never carry secrets in its payload — only claims the token holder is already allowed to see.
FAQ
Can I use this to check whether a token is valid?
No — decoding and verifying are different operations. This tool shows you what's inside a token, not whether it was legitimately issued. Anyone can construct a JWT with any claims they want; a service is only safe from that if it actually checks the signature server-side against its own secret or public key before trusting the payload.
The tool says my token is expired, but my app still accepts it — why?
The expiry check here is a plain comparison between exp
and your browser's local clock. Many JWT libraries apply a small leeway (a few seconds to a
few minutes) to tolerate clock skew between servers, which this tool doesn't replicate.