JWT Decoder
Paste a JSON Web Token to see its header and payload, plus whether it's expired.
This only decodes the token — it does not verify the signature. Never paste a token into a tool that also asks for its secret key.
Three segments, one honest limitation
A JWT is base64url(header).base64url(payload).signature.
This tool splits your input on the dots, converts each of the
first two segments from base64url back to standard base64
(swapping -/_ back to +// and restoring the padding atob()
expects), decodes it to UTF-8 text, and parses it as JSON. The
third segment — the signature — is shown exactly as written,
because checking it requires the issuer's secret or public key,
which has no business being typed into a website.
Worked example
Token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Decodes to header:
{
"alg": "HS256",
"typ": "JWT"
} and payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
This particular token has no exp claim, so there's
nothing to expire — paste in a token that has one and the badge
above the fields tells you at a glance whether it's still valid.
Frequently asked questions
Does this verify the token is genuine?
No — and no browser-side tool honestly can. Verifying a JWT's signature requires the secret key (for HS256) or the public key (for RS256/ES256) that issued it, and that key belongs on your server, never pasted into a website. This tool only decodes the header and payload so you can read what's inside — it never checks whether the signature is valid. Treat a decoded token as "readable", not as "trustworthy": anyone can decode a JWT, and anyone can forge one without the signing key, so authenticity has to be verified server-side.
What are the three parts of a JWT?
A JWT is three base64url-encoded segments joined by dots: header.payload.signature. The header names the signing algorithm and token type (typically {"alg":"HS256","typ":"JWT"}). The payload carries the claims — the actual data, like a user ID, an issuer, and an expiry time. The signature is computed by the issuing server over the header and payload using a secret only it knows, so a receiving server can confirm the token wasn't tampered with — but only if it also holds that secret.
Why is base64url different from regular base64?
Regular base64 uses +, /, and = as part of its alphabet, and all three are meaningful characters in a URL (+ can mean a space, / separates path segments, = starts a query string). base64url swaps + for -, / for _, and drops the = padding entirely, so a token can sit safely inside a URL or an HTTP header without needing to be percent-encoded. This tool converts base64url back to standard base64 before decoding, since that's the format the browser's own atob() expects.
Is my token uploaded anywhere?
No. Splitting the string and decoding it happens entirely in your browser with plain JavaScript — nothing is sent to a server, logged, or stored. That said, JWTs often carry real session data: don't paste a live production token into any tool, including this one, if you're not sure who else might see your screen.