What is a JWT Decoder?
A JSON Web Token (JWT) is a compact, URL-safe string used to represent claims between two parties — most commonly, proof that a user is authenticated. It's made of three Base64URL-encoded parts separated by dots: a header (describing the signing algorithm), a payload (the actual claims, like user ID and expiry), and a signature (proving the token wasn't tampered with). This tool decodes the header and payload so you can read what's actually inside a token — it deliberately does not and cannot verify the signature, since that requires the secret or public key the token was signed with, which this tool never asks for or sees.
When to use it
This is the tool you reach for when debugging authentication — a login isn't working, an API is rejecting a token as expired, or you need to confirm which claims (user ID, roles, expiry timestamp) are actually embedded in a token you're working with. It's also useful when integrating with a third-party auth provider and you want to sanity-check the shape of the tokens they're issuing before writing code against them.
How it works
JWTs use Base64URL encoding (a variant of Base64 that's safe to put directly in a URL, using - and _ instead of + and /) for the header and payload sections. This tool splits the token on its dots, Base64URL-decodes the first two segments, and pretty-prints the resulting JSON. The third segment (the signature) is intentionally left alone and unverified — decoding a JWT tells you what it claims, not whether those claims are trustworthy, which is why treating a decoded-but-unverified token as authenticated in your own code is a serious security mistake.
Frequently asked questions
Is it safe to paste a real JWT into this decoder?
Decoding happens entirely in your browser, so the token itself isn't transmitted anywhere. That said, JWTs often contain sensitive claims, so treat them the same way you'd treat any credential — avoid pasting production tokens into any tool, including this one, if you can reproduce the issue with a test token instead.
Why can't this tool verify if my JWT signature is valid?
Verifying a signature requires the secret key (for HMAC algorithms like HS256) or public key (for RSA/ECDSA algorithms) the token was signed with — something only the issuing server should have. A tool that could verify any signature without that key would mean the signing scheme isn't actually secure.
What does the 'exp' claim in my JWT payload mean?
exp is the standard claim for expiration time, given as a Unix timestamp (seconds since 1970). If the current time is past this value, the token is expired and a properly implemented server should reject it regardless of whether the signature is still valid.
Why does my decoded JWT payload look different from what I expected?
Double-check you're decoding the actual token string and not a wrapped version of it (some APIs prefix tokens with "Bearer " in headers — that prefix isn't part of the token itself and needs to be stripped first).