JWT Decoder

How to use the jwt decoder

1. Paste the full token, including both dots.
2. Read the decoded header and payload.
3. Check the expiry line to see whether the token is still valid.

About this tool

A JSON Web Token is three Base64url segments separated by dots: a header describing the algorithm, a payload of claims, and a signature. The first two are encoded, not encrypted — anyone holding the token can read them, which is why tokens should never carry secrets.

This decoder splits the token, decodes the header and payload, and translates the standard time claims (exp, iat, nbf) into local dates so you can see at a glance whether a token has expired. It does not verify the signature: that requires the issuer's key, and sending your signing key to a web page would be a bad idea. Verify signatures in your own backend.

Common uses

• Debugging why an API rejects a token as expired.
• Checking which scopes or roles a token carries.
• Confirming which issuer and algorithm a token declares.

Frequently asked questions

Does this verify the signature?

No, and deliberately so — verification needs the secret or public key, which should stay on your server. This tool only decodes the readable parts.

Is it safe to paste a token here?

Decoding happens in your browser and the token is not transmitted. Still, a live access token is a credential; prefer an expired or test token when you can, and rotate anything you have handled carelessly.

Why is the payload readable at all?

JWTs are signed, not encrypted. The signature proves the payload has not been altered; it does not hide it. Use JWE if the contents must be confidential.