About JSON Web Token (JWT) Decoder
This tool decodes a JWT (JSON Web Token) — the compact, three-part token format widely used for authentication and session data — into its readable Header and Payload JSON. It also shows the raw signature segment, common timing claims (iat, exp, nbf) converted to readable dates, and whether the token's own exp claim indicates it has expired. All decoding happens locally in your browser; your token is never uploaded to a server.
Decoding a JWT Is Not the Same as Verifying It
A JWT's header and payload are only Base64URL-encoded, not encrypted — anyone who has the token can decode and read its contents, exactly like this tool does, without needing any secret key. What actually protects a JWT from tampering is its signature (the third part), which can only be verified by whoever holds the correct secret key or public key. This tool deliberately does not attempt that verification, since doing so safely would require the private/secret key material, which should never be pasted into a third-party tool. In practice, this means: never trust the contents of a decoded token as authentic without your backend verifying the signature first — anyone can construct a JWT with any payload they like; only a valid, verified signature confirms it was actually issued by a trusted source and hasn't been altered.
Send Feedback
For any questions, bug reports, or feature requests, please use the form below to send us a message.