JWT Decoder
Decode a JSON Web Token's header and claims locally. Nothing is sent to a server.
What is inside a JWT
A JSON Web Token is three base64url-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries the claims, and the signature is what makes the whole thing trustworthy.
Crucially, the first two parts are only encoded, not encrypted. Anyone holding a token can read its contents — which is exactly what this tool does. Never put secrets, passwords or sensitive personal data in a JWT payload.
Common claims
sub— subject, usually the user IDiss— issuer, who created the tokenaud— audience, who it is intended forexp— expiry time (Unix seconds)iat— issued-at timenbf— not valid before this time
Frequently asked questions
Is it safe to paste a token here?
Decoding happens entirely in your browser with native JavaScript — the token is never transmitted. That said, a live token is a credential: treat it like a password, and prefer expired or test tokens where you can.
Why can't this verify the signature?
Verification requires the signing secret or public key. Sending a secret to a web page would be a far bigger risk than the convenience is worth, so verification belongs on your server.
My token is expired — what now?
Expiry is enforced by whatever validates the token, using the exp claim. You need to obtain a fresh token, normally via a refresh token or by re-authenticating.