JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format used widely for authentication and authorization in modern web APIs. It consists of three Base64URL-encoded parts separated by dots: a header (describing the token type and signing algorithm), a payload (the actual claims, like user ID or expiry time), and a signature (used to verify the token hasn't been tampered with).

How to use this tool

Paste a JWT into the input field and click Decode Token to see its header and payload as formatted JSON. This tool only decodes; it does not verify the signature, so it doesn't need (and never sees) the signing secret. Everything happens locally in your browser.

Common use cases

• Inspecting the claims (like expiry time or user ID) inside an access token while debugging authentication.
• Checking which signing algorithm a token's header specifies before implementing verification.
• Confirming an API returned the expected payload fields after a login or token refresh.
• Learning how JWTs are structured without needing to write any decoding code yourself.

Frequently asked questions

Is decoding a JWT the same as verifying it?

No, and this is an important distinction. Decoding just reads the header and payload, both of which are only Base64URL-encoded, not encrypted, so anyone can read them. Verifying additionally checks the signature against a secret or public key to confirm the token wasn't tampered with. This tool only decodes.

Is it safe to paste a real access token into this tool?

Decoding happens entirely in your browser and the token is never sent to our server, but as a general rule, avoid pasting production tokens (especially ones with elevated privileges) into any third-party tool, since anyone able to read a valid, unexpired token can potentially use it.

Why can I read the payload without a secret key?

A JWT's header and payload are only Base64URL-encoded, not encrypted, by design, so any client can read the claims. The signature exists to prove the token hasn't been altered, not to hide its contents.

What do iat, exp, and sub mean in the payload?

These are standard registered claim names: iat is when the token was issued (issued-at), exp is when it expires, and sub identifies the subject the token is about, usually a user ID.