JWT Decoder
Decode a JSON Web Token header and payload (base64url) to inspect claims.
Private by design. Every tool runs 100% in your browser — your code, text, and tokens never leave your device. Nothing is uploaded or stored.
This decodes the token locally so you can inspect its claims. It does not verify the signature, so a token's authenticity is not confirmed.
Header
Decoded header appears here.
PayloadDecoded payload appears here.
Frequently Asked Questions
Is decoding a JWT the same as verifying it?
No. Decoding only base64url-decodes the payload so you can read claims; it does NOT check the signature. Never trust decoded claims without signature verification on the server.
Why can I read the payload if it is signed?
JWTs are signed, not encrypted. The signature proves integrity, but the payload is plainly readable by anyone holding the token — never put secrets in a JWT.
What do exp and iat mean?
exp is the expiry timestamp; iat is issued-at. Both are Unix seconds. The decoder shows them as human dates so you can spot expired tokens.