JWT Decoder
Runs entirely in your browser
Decode a JWT's header and payload directly in your browser.
Decoding a JWT does not verify its signature. Never trust a token's claims without server-side verification.
What is JWT Decoder?
A JSON Web Token (JWT) is a compact, three-part token used for authentication and authorization. JWT Decoder splits it into its Header, Payload and Signature, decodes the Header and Payload from Base64url to readable JSON, and highlights common time-based claims.
How to use JWT Decoder
- Paste a JWT into the input box.
- Click Decode.
- Review the decoded header and payload, and copy either one.
Features
- Splits a JWT into Header, Payload and Signature.
- Decodes the Header and Payload as formatted JSON.
- Shows human-readable issued-at (iat) and expiration (exp) times when present.
- 100% client-side — your token never leaves your browser.
Frequently Asked Questions
Does decoding a JWT verify it?
No. Decoding a JWT does not verify its signature. Anyone can decode a JWT's header and payload — only a server holding the correct secret or public key can confirm the token is authentic and untampered.
Is my token uploaded to a server?
No. The token is decoded entirely in your browser and never sent anywhere — but you should still avoid pasting production tokens into any tool you don't fully trust.
What do exp and iat mean?
exp (expiration time) and iat (issued at) are standard JWT claims storing Unix timestamps. When present, this tool shows both as human-readable dates.
What happens if the token is invalid?
You'll see a clear error message. A JWT must have exactly three Base64url segments separated by dots, with valid JSON in the header and payload.