Utilities Center

JWT Decoder

Decode JSON Web Token header & payload

Paste a JWT to instantly inspect its header and payload as readable JSON, plus the signature — all decoded in your browser.

Header
Decoded header will appear here.
Payload
Decoded payload will appear here.
Signature
Signature segment will appear here.

About the jwt decoder

A JSON Web Token (JWT) is a compact, URL-safe token used to transmit claims between parties — most commonly for authentication. A JWT has three Base64URL-encoded segments separated by dots: header.payload.signature.

This decoder Base64URL-decodes the header and payload segments and pretty-prints them as readable JSON so you can inspect the algorithm, token type, and any registered claims (such as iss, sub, exp, and iat) at a glance. The signature segment is shown as-is.

Important

  • Decoding is not verification. This tool reads the payload but does not check the signature, so a decoded token is not proof of authenticity.
  • Never paste production secrets. Although decoding happens in your browser, treat tokens as sensitive credentials.
  • Timestamp claims (exp, nbf, iat) are shown in both Unix seconds and a human-readable UTC date.

How to use the jwt decoder

  1. Paste your JWT

    Drop a token in the format header.payload.signature into the input box.

  2. Read the decoded sections

    The header and payload appear as pretty-printed JSON below, with the signature shown separately.

  3. Copy any section

    Use the Copy button next to the header, payload, or signature to copy it to your clipboard.

Frequently asked questions

Does this tool verify the JWT signature?
No. It only decodes the header and payload so you can read them. Verifying a signature requires the signing secret or public key and is a separate operation best done in your backend.
Why does my payload show strange characters?
JWT segments use Base64URL encoding. This tool decodes them as UTF-8; if your token was generated with a different encoding, the output may look unusual.
What do the exp, iat, and nbf claims mean?
exp is the expiry time, iat is the issued-at time, and nbf is the not-before time. They are Unix timestamps in seconds and are shown here with a readable UTC date.
Is my token sent to a server?
No. All decoding happens entirely in your browser, so the token never leaves your device. Still, avoid pasting highly sensitive production tokens.
Can a JWT have more than three segments?
A standard JWS has three segments. Some encrypted JWE tokens have five. This tool decodes the first two segments as header and payload regardless of the total count.

Explore more utilities

Other utilities