About the JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and authorization, typically sent in the Authorization header of API requests. It contains three Base64URL-encoded parts separated by dots: a header that describes the signing algorithm, a payload with claims such as the user ID and expiry time, and a signature. This decoder shows the header and payload as readable JSON and converts the time claims into dates in your language. The token is decoded in your browser and never sent anywhere.
How to use it
- Paste a JWT into the box. A leading “Bearer ” prefix is removed automatically.
- Read the decoded header and payload, shown as formatted JSON.
- Check the issued-at, not-before and expiry dates, and whether the token has expired.
- Copy the header or payload if you need it elsewhere.
Frequently asked questions
Does this tool verify the signature?
No. Verifying a signature requires the secret or public key used to sign the token. Never trust a token's content in your application without verifying it on your server.
Is it safe to paste a real token here?
The token is decoded locally and is never transmitted. Still, treat valid tokens like passwords: anyone who has one can use it until it expires.
Are JWT payloads encrypted?
Standard signed JWTs (JWS) are only encoded, not encrypted, so anyone can read their content. Do not put secrets in a JWT payload.