JWT Decoder
Header
Payload
Signature (not verified)
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties, commonly used for authentication. It consists of three Base64URL-encoded parts separated by periods: a header describing the signing algorithm, a payload containing the claims, and a signature used to verify the token wasn't tampered with.
When would I use this?
- Debugging why an API rejects a token, by inspecting its claims and expiration.
- Checking what data a third-party token actually contains before trusting it.
- Verifying the exp (expiration) or iat (issued-at) claims during development.
How it works
This tool splits the token on periods and Base64URL-decodes the header and payload segments in your browser. It does not verify the cryptographic signature — decoding is not the same as validating authenticity.
Frequently asked questions
Decoding happens entirely in your browser — the token is never sent to any server. That said, as a general security practice, avoid pasting tokens into any third-party tool if you can decode them locally instead.
No, this tool decodes the header and payload only (Base64URL decoding), it does not verify the signature against a secret or public key. A decoded JWT should never be trusted as authentic without signature verification on your backend.
A valid JWT has exactly three Base64URL segments separated by periods (header.payload.signature). Make sure you copied the full token with no line breaks or extra whitespace.
The header specifies the token type and signing algorithm (e.g. HS256). The payload contains the claims — the actual data, such as user ID, expiration (exp), and issuer (iss).