JWT Decoder
Decode JWT headers and payloads instantly in your browser. Human-readable claims and timestamps. Decoding does not verify the signature.
Processed locally in your browser — nothing is uploaded.
0 characters
Decoding does not verify the signature. Anyone can create a token with any contents — a decoded JWT proves nothing about who issued it or whether it was tampered with. Always verify signatures server-side before trusting claims.
About JWT Decoder
A JWT is three Base64URL-encoded segments: header, payload, and signature. This tool decodes the header and payload into readable JSON, explains registered claims like iss, sub, aud, exp, iat, and nbf, and converts timestamp claims into human-readable dates.
Decoding is not verification. Anyone can read or forge the contents of a JWT — only checking the cryptographic signature against the issuer's key proves a token is authentic. Never trust a decoded token's claims without verifying its signature server-side.
Common uses
- Inspect what claims your auth provider actually puts in a token
- Debug 401 responses by checking a token's expiry and audience
- Understand a token found in a request header or cookie
Limitations
- The signature is NOT verified — decoded contents prove nothing about authenticity
- Encrypted tokens (JWE) cannot be decoded, only their header is readable