Online JWT decoder
A JWT (JSON Web Token) has three dot-separated Base64URL parts: header, payload and signature. This JWT decoder turns the first two into readable JSON so you can inspect claims (like sub, iss, exp) and see the exp as a human-readable time — handy for debugging auth. Everything is decoded locally.
How to use
- Paste a full JWT into the input box.
- The decoded header and payload appear below in real time.
- Check whether exp has passed and whether the claims are correct.
Important notes
- This decodes only — it does not verify the signature (that needs a secret key, which should never go into an online tool).
- The payload is readable by anyone; never put secrets in it.
- A token is like a password — be careful when sharing.
Decoding shows the contents — it doesn't verify the signature
When you're chasing down a login bug, the quickest move is to paste the JWT here and read its claims, the issuer, and the exp expiry time — plenty of 'my credentials are right but I keep getting logged out' cases turn out to be a token that expired ages ago. Two ideas are worth burning into memory, though. First, decoding is not verification: this only reads the contents, it never checks whether the signature is valid, so a token that decodes cleanly still isn't necessarily trustworthy. Second, the payload isn't encrypted — it's just Base64, and anyone holding the token can read it, so never stuff a password, key, or any secret into it.
Why does it decode without any key?
Because a JWT is not encrypted. We pasted the sample token from the specification into this page with no key at all: the header came back as { "alg": "HS256", "typ": "JWT" } and the payload as { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }. Nothing was decrypted, because nothing was encrypted — the first two segments are Base64url text, and the signature protects them from modification, not from reading. So a JWT must never carry anything you would not put in a URL, and pasting a full token into a bug report hands over a working credential until it expires.