JWT Decoder

Safely inspect a JSON Web Token locally in your browser.

Paste a JWT token

Header . Payload . Signature

Privacy: decoding happens in this browser. Your token is never sent to our server. Do not share production secrets.

What is a JWT?

A JSON Web Token usually contains three Base64URL strings separated by dots: Header, Payload and Signature. The header describes the algorithm, the payload carries claims, and the signature supports integrity checks. The payload is encoded, not encrypted, so anyone holding a token can read it.

How to use this tool

  1. Copy the complete JWT from an app, browser developer tools or an API response.
  2. Paste it above to automatically decode and format the JSON.
  3. Review claims and timestamps. Verify trust and signatures on your server with the correct key.

Frequently asked questions

Is my JWT uploaded?

No. JavaScript decodes the token locally and no request containing the token is made.

Does decoding prove a JWT is valid?

No. Decoding does not verify the signature, key, permissions or issuer. Always verify on a trusted server.

Why do I get a Base64URL or JSON error?

Make sure all three segments were copied without quotes, extra spaces or line breaks. Remove a leading Bearer prefix.

What do exp, iat and nbf mean?

exp is expiration, iat is issued-at and nbf is not-before. They are normally Unix timestamps in seconds and are shown with local status.