JWT Decoder
Paste a JWT to see its header and payload. Decoding happens locally — this tool never verifies a signature against a secret, because doing that safely would require either shipping your secret to the browser or sending your token to a server. Neither happens here.
Header
Payload
What this tool does and doesn't do
A JWT's header and payload are Base64URL-encoded, not encrypted — anyone holding the token can already read them, so decoding them locally loses nothing over decoding them on a remote server. The difference is that a remote decoder can log every token it ever receives, including yours.
This tool intentionally stops at decoding. It does not check the signature, because a trustworthy signature check needs your service's real secret or public key, and that key should never leave your own infrastructure.
JWT structure, in short
A JWT is three Base64URL segments joined by dots:
header.payload.signature. The header usually
carries alg (the signing algorithm, e.g. HS256 or
RS256) and
typ. The payload holds whatever claims the
issuer put there — commonly the registered ones:
iss (issuer),
sub (subject),
aud (audience),
exp (expiry),
nbf (not-before), and
iat (issued-at) — plus any custom claims the service
adds.
Because none of that is encrypted, a JWT should never carry secrets in its payload — only claims the token holder is already allowed to see.
FAQ
Can I use this to check whether a token is valid?
No — decoding and verifying are different operations. This tool shows you what's inside a token, not whether it was legitimately issued. Anyone can construct a JWT with any claims they want; a service is only safe from that if it actually checks the signature server-side against its own secret or public key before trusting the payload.
The tool says my token is expired, but my app still accepts it — why?
The expiry check here is a plain comparison between exp
and your browser's local clock. Many JWT libraries apply a small leeway (a few seconds to a few
minutes) to tolerate clock skew between servers, which this tool doesn't replicate.
Related tools
- Base64 Encoder & Decoder — Encode and decode Base64 and Base64URL, text or files.
- X.509 Certificate Decoder — Paste a PEM certificate or chain: subject, names, expiry, fingerprints.
- UUID & Hash Generator — Generate v4 UUIDs, or SHA-1/256/384/512 hashes of any text.
- Format Identifier — Paste anything to find out what it is (a JWT, JSON, a certificate, Base64, a cron schedule and more), then open it in the right tool.