JWT Decoder
Decode, inspect, and verify JWTs.
Verify signature (HS256)
About the JWT Decoder
Splits a JSON Web Token into its header and payload and renders both as readable JSON, including the standard time claims. Because a JWT payload is only Base64url-encoded, anyone holding the token can read it. Decoding it locally rather than pasting it into a remote service is the difference between inspecting a credential and leaking one.
How to use the JWT Decoder
- Paste the full token, including both dots.
- Read the decoded header to see the signing algorithm.
- Read the payload for claims such as sub, iat, and exp.
Frequently asked questions
- Does this verify the signature?
- No. It decodes and displays the token. Signature verification needs the issuer's secret or public key, and that verification belongs on your server, not in a web page.
- Is it safe to paste a real access token here?
- Safer than in a tool with a backend, because decoding happens in your browser and the token is never transmitted. Treat any token you have pasted anywhere as worth rotating if you are unsure.
- What do iat, exp, and nbf mean?
- Issued-at, expiry, and not-before, all as Unix timestamps in seconds. A token is valid between nbf and exp.
- Why is the payload readable without a key?
- A signed JWT is not encrypted. The signature proves the payload was not tampered with, it does not hide it. Never put secrets in a JWT payload.
Related tools
- Base64 Encode/DecodeEncode and decode Base64 strings.
- HTML Entity EncoderEncode and decode HTML entities.
- Text to Binary ConverterTranslate text to binary and back.
- URL Encode/DecodeEncode and decode URL components.
- Base64 to ImageDecode Base64 strings to images.
- Image to Base64Convert images to Base64 data URLs.