JWT Decoder
Decode a JSON Web Token's header and payload. Runs entirely in your browser — the token is never sent anywhere.
This decodes only — it does not verify the signature. Anyone can read a JWT's contents, so never treat a decoded token as trusted, and never paste a signing secret into any website.
About JWT Decoder
JWT Decoder splits a JSON Web Token into its three parts and shows you the header and payload as readable JSON, along with whether the token has expired. Decoding happens entirely in your browser, which matters because a JWT is a live credential.
A JWT is three Base64URL-encoded segments joined by dots: a header describing the signing algorithm, a payload of claims, and a signature over the first two. The critical thing to understand is that the first two segments are merely encoded, not encrypted. Anyone holding the token can read every claim inside it without any key at all — which is exactly what this page does.
That has a direct consequence for what you put in one. Claims are visible to the user and to anyone who obtains the token, so a JWT is the wrong place for anything confidential. It is equally the reason a token should be treated like a password in transit and at rest: possession alone is usually sufficient to act as that user until it expires.
The signature is what makes a token trustworthy, and verifying it requires the signing secret or public key. This tool deliberately does not verify, because the only way to offer that in a web page would be to ask you to paste a signing secret into it — a habit worth never acquiring. Read the claims here; verify in your application, where the key already lives.
How to decode a JWT
- Copy the whole token, including both dots and all three segments.
- Paste it into the box — a leading 'Bearer ' prefix is stripped automatically.
- Click Decode.
- Read the header for the algorithm, and the payload for the claims.
- Check the expiry banner to see whether the token is still valid.
Tips & common problems
Expiry is in Unix seconds
The exp and iat claims are seconds since 1970, not milliseconds. A common bug is comparing them against JavaScript's Date.now(), which is in milliseconds and makes every token look long expired.
Three segments, always
If your token has the wrong number of dots it was probably truncated when copied, or you copied a session identifier rather than a JWT.
Never paste a signing secret anywhere
Reading a token needs no key. Any site asking for your secret in order to 'verify' a token is asking for the keys to issue tokens of its own.
Treat tokens as credentials
A JWT usually grants access on its own. Avoid pasting production tokens into chat, tickets or screenshots, and revoke anything that has been exposed.
Frequently asked questions
Is my token sent anywhere when I decode it?
No. Decoding happens entirely in your browser. This is deliberate: a JWT is a bearer credential, and transmitting one to a third-party server to read it would be genuinely unsafe.
Does this verify the token's signature?
No, and that is intentional. Verification requires the signing secret or public key, and no legitimate tool should ask you to paste a signing secret into a website. Verify inside your own application instead.
Can anyone read the contents of my JWT?
Yes. The header and payload are only Base64-encoded, not encrypted, so any holder of the token can read every claim. Never put confidential data in a JWT payload.
What do exp and iat mean?
They are the expiry and issued-at timestamps, expressed as seconds since 1 January 1970. This page converts them to readable local times and tells you whether the token has already expired.
Why does my token fail to decode?
The usual causes are a truncated copy, a missing segment, or that the string is not actually a JWT. A valid token has exactly three dot-separated Base64URL segments.
Is it safe to decode a production token here?
The decoding itself is local and safe. The wider risk is having the token in your clipboard and browser history at all — so prefer a test token, and rotate anything you believe has been exposed.