JWT Decoder

A JWT decoder extracts the Base64URL-encoded header and payload from a JSON Web Token and displays them as readable JSON. It also shows the signature segment and interprets common registered claims such as iss, sub, exp, iat and nbf.

Paste your JWT into the input field and click Decode JWT. The tool splits the token into its three sections, Base64URL-decodes the header and payload, and displays the formatted JSON, signature, claim meanings and timestamps.

Yes. The header and payload of a standard JWT are only Base64URL-encoded, not encrypted. Anyone who has the token can decode them without a key. This is why you should never put sensitive information in a JWT payload unless your design specifically provides confidentiality.

Decoding itself is safe — it only reverses an encoding. However, the contents of a JWT may include user IDs, email addresses, roles or session information. Avoid pasting production tokens into tools you do not trust. This tool processes JWTs entirely in your browser.

No. Decoding does not verify the signature. Verification requires the signing algorithm and a secret or public key to cryptographically confirm the token has not been altered. This tool is a decoder only — it never claims a signature is valid.

Not by default. Standard JWT signing provides integrity and authentication, not confidentiality. The payload is encoded as Base64URL, which anyone can reverse. If you need confidentiality, use an encrypted token format such as JWE, or encrypt the payload before placing it in a JWT.

The header is a JSON object that describes the token. It typically contains the signing algorithm (alg), the token type (typ) and an optional key ID (kid). The header is metadata about the token, not a verified claim.

The payload is a JSON object containing claims — statements about an entity (usually the user) and additional data. Claims include registered names defined by the JWT specification (iss, sub, exp, iat, nbf, jti) and custom private claims specific to an application.

exp (Expiration Time) is a registered claim that identifies the time after which the JWT must not be accepted for processing. The value is a JWT NumericDate: seconds since the Unix epoch.

iat (Issued At) is a registered claim that identifies the time at which the JWT was issued. The value is a JWT NumericDate: seconds since the Unix epoch.

nbf (Not Before) is a registered claim that identifies the time before which the JWT must not be accepted for processing. The value is a JWT NumericDate: seconds since the Unix epoch.

Decoding reverses the Base64URL encoding to reveal the header and payload. Verification uses the signing algorithm and a secret or public key to cryptographically confirm that the signature matches the header and payload and that the token has not been altered. Decoding requires no key; verification requires the correct key.

Only if you understand the privacy implications. A JWT payload can contain user IDs, email addresses, roles, permissions or session information. This tool processes tokens locally in your browser, but you should still avoid pasting production authentication tokens into tools you do not fully trust. Consider decoding in your own environment or redacting sensitive claims first.