Security Tools

JWT Decoder

Instantly decode a JWT's header and payload, right in your browser.

Free & instant No signup How to use FAQ

Paste your JWT

Decoding happens entirely in your browser - your token is never sent to our servers.

This only decodes the token's contents - it does not verify the signature. A decoded token could still be invalid, expired, or tampered with; only your backend, using the correct secret/key, can verify that.

Header

Payload

Not sure what to enter?

Paste your JWT below to instantly decode its header and payload - entirely in your browser, your token is never sent to our servers.

What is a JWT?

A JSON Web Token (JWT) is a compact, signed token made of three Base64URL-encoded parts: a header (algorithm), a payload (claims such as sub, iat and exp) and a signature. This decoder shows the header and payload in readable JSON, entirely in your browser - the token is never sent anywhere.

How to decode a JWT

Paste the token (it starts with eyJ...) into the box above.
Click Decode JWT.
Read the header and payload claims; exp is the expiry time as a Unix timestamp.
Decoding does not verify the signature - never trust a token's claims without verifying it on your server.

Related checks

To turn exp/iat values into dates, use the Unix Timestamp Converter.
To decode other Base64 text, use the Base64 Encoder / Decoder.

Decoding a JWT does not prove it is genuine - always verify the signature on your server before trusting what it says. This decoder runs entirely in your browser, so the token you paste is never sent anywhere.

Frequently Asked Questions

No - decoding happens entirely in your browser using JavaScript. Your token, including any sensitive claims it contains, is never transmitted anywhere.

No - it only decodes the header and payload, which are Base64URL-encoded but not encrypted or protected. Verifying a signature requires the issuer's secret or public key, which only your backend should have.

No - anyone can craft a JWT with arbitrary header/payload content. Only a signature verification (done server-side, with the correct secret/key) proves a token is genuine and untampered.

A JWT has a header (algorithm and token type), a payload (the claims/data), and a signature (used to verify authenticity) - each separated by a period and independently Base64URL-encoded.

Share this tool:

Need a website for your business? Only $599