JWT Decoder
Decode a JWT header and payload.
Your token is processed entirely in your browser — never uploaded or stored. Signature is not verified.
What is this tool?
The JWT decoder decodes a JSON Web Token's header and payload into readable JSON instantly — handy for inspecting or debugging login sessions and API auth tokens.
Structure
- Header: holds metadata like token type (
typ) and signing algorithm (alg). - Payload: holds claims such as subject (
sub), issued-at (iat), and expiry (exp). - Signature: proves the header/payload weren't tampered with; verifying it requires the secret or public key.
Note: This tool does not verify the signature. The header and payload are only Base64URL-encoded, not encrypted, so anyone can read them.
Privacy & processing
Everything runs in your browser. Your token is never uploaded or stored, and you can copy the payload to your clipboard.
FAQ
What is a JWT?
A JWT (JSON Web Token) is a standard token format for securely exchanging JSON data between parties. It has three dot-separated parts — header, payload, and signature — and is widely used for login sessions and API auth.
What's in the header and payload?
The header holds metadata like token type and signing algorithm (alg); the payload holds actual claim data such as subject (sub), issued-at (iat) and expiry (exp). Both are only Base64URL-encoded, not encrypted.
Does this tool verify the signature?
No. This tool only decodes the header and payload to show their content; it does not perform signature verification, which requires the issuing server's secret or public key.
How do I know if a token has expired?
If the payload has an exp (expiry) claim, it's compared against the current time and highlighted on screen. If exp is missing, the tool notes that expiry can't be determined.
Is my token sent to a server?
No. All decoding happens in your browser; your token is never uploaded or stored.
Advertisement