JWT Decoder
Paste a JSON Web Token to read its header and claims. Decoding happens in your browser; the token is never sent anywhere.
How it works
A JWT has three Base64URL-encoded parts separated by dots: header, payload and signature. The header names the signing algorithm, and the payload carries claims such as sub (subject), iat (issued at), exp (expires) and iss (issuer).
This tool only decodes. It does not verify the signature. Anyone can read the payload of a JWT, so never put secrets in one, and always verify the signature on your server before trusting any claim.
Frequently asked questions
Is it safe to paste my JWT here?
Decoding happens locally and nothing is transmitted. Still, treat live access tokens as secrets and avoid pasting production tokens into any website.
Does this verify the token?
No. Verification needs the secret or public key and should be done on your server.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when the token was issued and nbf is the time before which it must not be accepted, all as Unix timestamps in seconds.