JWT Decoder
Paste a JWT to decode its header and payload. This tool only decodes — it does not and cannot verify the signature, since that requires the issuer's secret or public key, which the token itself never carries. Runs entirely in your browser.
How it works
A JWT has three dot-separated parts: header.payload.signature. The
header and payload are JSON, base64url-encoded (not encrypted) — anyone can decode
them, which is why JWTs should never carry secrets in the payload. The signature
proves the token wasn't tampered with, but verifying it requires the issuer's key,
which this tool deliberately does not ask for.
FAQ
Why can't this tool verify the signature? Verification needs the secret (HMAC algorithms) or public key (RSA/ECDSA algorithms) that only the issuer holds. A client-side tool that asked for your secret to "verify" a token would be a security anti-pattern — never paste a signing secret into any website.
What are exp, iat, and nbf?
Standard timestamp claims: exp (expiration), iat (issued at),
and nbf (not before) — all Unix seconds. This tool converts them to
readable dates and flags whether the token is expired.