JWT Decoder
Decode a JWT to read its header, payload and claims, with expiry checked.
Token
Decoded in your browser. A leading Bearer is ignored, so you can paste an Authorization header directly.
About this JWT decoder
A JSON Web Token is three Base64URL-encoded parts separated by dots: a header saying how it was signed, a payload of claims, and a signature over the first two. This page decodes the first two parts and explains the claims, entirely in your browser.
A JWT is not encrypted
This is the single most misunderstood thing about the format. The payload is encoded, not encrypted — anyone holding the token can read every claim in it, no key required, which is exactly what this page is doing. The signature stops a token being modified, not read. Never put anything secret in a JWT payload.
Why this tool does not verify signatures
Verifying requires the signing secret or public key. A web page that invites you to paste a production HMAC secret into a form is a bad habit to encourage, however client-side it claims to be — so this tool decodes only. Verify tokens in your backend, or with a local library, where the key already lives.
That also means a decoded token proves nothing about validity. A JWT can be entirely readable here and still be forged, expired or signed by the wrong key.
Registered claims
ississuer,subsubject,audaudience — who made it, who it is about, who it is for.expexpiry andnbfnot-before define the validity window. Both are Unix timestamps in seconds, which is a classic source of bugs in JavaScript whereDate.now()is milliseconds.iatissued-at, andjtia unique ID used to detect replay.
Common decoding problems
JWTs use Base64URL and drop the = padding, so a decoder expecting standard Base64 may reject them — this one accepts both. If your token has five parts rather than three it is a JWE, which is genuinely encrypted and cannot be read without the key. And if the payload is not valid JSON after decoding, the token was probably truncated in transit.