JWT Decoder
Paste a JSON Web Token to see its decoded header and payload — instantly, entirely in your browser.
A JWT (JSON Web Token) is three base64url-encoded segments joined by dots: a header (algorithm/type), a payload (claims such as sub, iat, exp), and a signature. The header and payload are not encrypted — anyone holding the token can read them — only the signature proves the token wasn't tampered with by whoever holds the signing key.
This decoder splits the token, base64url-decodes the header and payload, pretty-prints the JSON, and converts iat/exp/nbf timestamps into readable dates. It does not verify the signature — that requires the signing key/secret, which this page never asks for. Everything happens in JavaScript running in your browser; the token you paste is never sent anywhere, which matters since JWTs often carry session or identity data.
Frequently asked questions
Is my token sent to your server?
No. Decoding runs entirely in your browser's JavaScript. The token never leaves your machine over the network.
Why doesn't this tool verify the signature?
Verifying a signature requires the secret or public key used to sign the token. This is a read-only decoder for inspecting claims, not a security validator.
What do exp and iat mean?
`iat` (issued at) and `exp` (expiration) are Unix timestamps (seconds since epoch). This tool converts them to human-readable dates and flags a token as expired if `exp` is in the past.