JWT Decoder
Decode a JSON Web Token to inspect its header, payload, and signature instantly.
How to Use
- Paste a JWT (the long dot-separated string) into the input.
- The header and payload decode instantly into readable JSON.
- Check the "exp" claim to see expiry time, shown in local time.
- The signature segment is shown but not verified — verification requires your secret/private key.
Frequently Asked Questions
QDoes this verify the signature?
No — verifying a signature requires the secret (HMAC) or public key (RSA/ECDSA), which should never be pasted into a third-party tool. This decoder only base64url-decodes the header and payload.
QIs my token sent anywhere?
No — decoding happens entirely in your browser using JavaScript's built-in base64 functions. Nothing is transmitted.
QWhat is a JWT?
A JSON Web Token is a compact, URL-safe token format consisting of three base64url-encoded segments separated by dots: header.payload.signature.
About This Tool
JWTs (RFC 7519) are widely used for authentication and authorization. Each token has a header (algorithm/type), a payload (claims), and a signature. This tool decodes the first two segments client-side.