JWT Decoder
JWT decoder
A JWT has three Base64URL parts split by dots: header.payload.signature. Decoding reveals the header and the payload claims as JSON — the parts are encoded, not encrypted, so anyone can read them (no key needed). Paste a token below to see its claims, with exp and iat as readable dates. This tool decodes but does not verify the signature.
Header
Payload
Frequently asked questions
What is a JWT?
A JSON Web Token — three Base64URL parts (header.payload.signature) carrying auth data between server and client.
How do I decode a JWT?
Split on the dots and Base64URL-decode the first two parts to JSON. This tool does it and formats exp/iat as dates. No key needed.
Does decoding verify the signature?
No — decoding only reads the (encoded, not encrypted) header and payload. Verifying needs the key. This tool decodes but doesn't verify.
Decoding happens entirely in your browser — your token is never sent anywhere. Don't paste production tokens on any site you don't trust.