JWT decoder
Paste a JSON Web Token to read its header and claims, with issued-at and expiry times shown as dates. Your token never leaves the page.
Runs entirely in your browser. Nothing you enter is sent to a server.
Encoders
What’s inside a JWT
A JWT has three Base64URL parts separated by dots: a header (algorithm and type), a payload of claims (such as sub, exp and iat) and a signature. Decoding shows the header and payload; it does not verify the signature, which needs the issuer’s secret or public key.
Treat tokens like passwords. This decoder runs entirely in your browser, but avoid pasting production tokens into tools you don’t trust.
Frequently asked questions
Is Base64 encryption?
No. Base64 only changes how data is written; anyone can decode it. Use proper encryption for secrets.
Does it handle emoji and accents?
Yes. Text is converted to UTF-8 bytes before encoding, so any language works.
Does the JWT decoder verify signatures?
No. It decodes the header and payload only. Verifying requires the signing key, which should stay on your server.