JWT Decoder

#Decode a JSON Web Token (JWT)

Paste a three-part token and choose Decode. The tool splits header.payload.signature, Base64url-decodes the first two parts, and parses them as JSON. The output lets you inspect the declared algorithm and claims without sending the token to a decoding API.

The third part is a cryptographic signature to a signed JWT . This page does not verify the signature . Encrypted JWTs are a different five-part compact serialization beyond the scope of this decoder.

#Decoding is not verifying

Anyone with a standard signed JWT can read the header and payload of a signed JWT. Base64url is an encoding scheme, not an encryption scheme. The decoded JSON tells you what the token says, not who created the token, whether the contents were changed, or whether your app should trust it.

Verification should be performed in the system that consumes the token. Use a supported JWT library with trusted keys, restrict acceptable algorithms, and validate application-specific requirements such as issuer and audience. Do not make authorization decisions from the output of this decoder.

#Common claims

• iss identifies the issuer.
• sub identifies the subject.
• aud identifies the intended audience.
• exp, iat, and nbf are NumericDate values expressed as seconds since the Unix epoch.

The decoder reports an expiry hint when exp is numeric. That local clock comparison is convenient for debugging, not sufficient validation. Real verification must also account for trusted time, allowed clock skew, issuer rules, revocation or session state, and the rest of your authentication design.

#Do not paste an active token unless you have to

The decoding logic runs in the browser but bearer tokens are credentials: anyone who gets hold of a valid one can potentially use it. For debugging, use a token from a local test environment or replace claims and re-sign a fixture. Never put passwords, private keys, secrets in a JWT payload. Signed payloads are still readable.

For a fuller walkthrough, see How to Decode a JWT. For standard Base64 text rather than JWT's Base64url segments, use the Base64 tool.

#FAQ

#Does this verify the JWT signature?

Nope. It just decodes the header and payload. In your token-reliant application, validate the signature and all required claims with a well-established library.

#Can a signed JWT hide its payload?

No. Properly verified, signing preserves integrity and authenticity, but it does not encrypt the claims. If confidentiality is required, use a suitable encrypted token design.