JWT Decoder
Decode JWT headers and payloads instantly in your browser. Human-readable claims and timestamps. Decoding does not verify the signature.
Processed locally in your browser — nothing is uploaded.
JWT Decoder
0 characters
Decoding does not verify the signature. Anyone can create a token with any contents — a decoded JWT proves nothing about who issued it or whether it was tampered with. Always verify signatures server-side before trusting claims.
About JWT Decoder
A JWT is three Base64URL-encoded segments: header, payload, and signature. This tool decodes the header and payload into readable JSON, explains registered claims like iss, sub, aud, exp, iat, and nbf, and converts timestamp claims into human-readable dates.
Decoding is not verification. Anyone can read or forge the contents of a JWT — only checking the cryptographic signature against the issuer's key proves a token is authentic. Never trust a decoded token's claims without verifying its signature server-side.
Common uses
- Inspect what claims your auth provider actually puts in a token
- Debug 401 responses by checking a token's expiry and audience
- Understand a token found in a request header or cookie
Limitations
- The signature is NOT verified — decoded contents prove nothing about authenticity
- Encrypted tokens (JWE) cannot be decoded, only their header is readable
Frequently asked questions
Is it safe to paste a real JWT into an online decoder?
With this tool, yes — decoding runs entirely in your browser and the token is never transmitted or stored. That matters because a live JWT is a bearer credential: anyone who obtains it can use it, so avoid decoders that send tokens to a server.
Why can I read a JWT without the secret key?
Because the header and payload are Base64URL-encoded, not encrypted — encoding is a reversible text format, not a secrecy mechanism. The key is only needed to create or verify the signature, so never put secrets in JWT claims.
What do the iss, sub, aud, and exp claims mean?
They are registered claims from RFC 7519: iss is the issuer that signed the token, sub is the subject it describes (usually a user ID), aud is the intended audience, and exp is the Unix timestamp after which it is invalid. This tool annotates each registered claim and converts timestamps to readable dates.
Does decoding a JWT prove it's valid?
No. Decoding only reads the contents; validity requires verifying the signature against the issuer's key and checking claims like exp and aud. A forged token decodes just as cleanly as a real one, which is why servers must always verify.
Why won't my JWT decode?
Usually the copy is incomplete — a JWT needs its dot-separated header and payload segments, and a truncated paste breaks the Base64URL. A token with 5 segments is an encrypted JWE, whose payload cannot be read without the key; a Bearer prefix, surrounding quotes, or line breaks are fine because this tool strips them.