JWT Decoder
Decode JWT headers and payloads to inspect claims.
Decoded entirely in your browser. Your token is never sent anywhere — this tool does not verify signatures against a secret.
Overview
Decodes a JSON Web Token's header and payload so you can inspect its claims — without verifying the signature, since that would require your signing secret.
How to use it
- 1Paste a JWT (three base64url segments separated by dots).
- 2The header and payload are decoded and shown as formatted JSON.
- 3Expiry (exp) and issued-at (iat) claims are converted to readable dates.
How it works
A JWT is three base64url-encoded segments — header, payload and signature — joined with dots. This tool base64url-decodes the first two segments and parses them as JSON; it never attempts to verify the signature.
Tips
- This tool cannot tell you if a token is genuine — only its issuer, using the signing secret, can verify that. Decoding just reveals what the token claims.