JWT Decoder
Decode a JWT to read its header and claims — safely, in your browser.
How this reads your output
A JWT is three Base64URL segments joined by dots: header, payload and signature. The tool decodes the first two — which are just JSON — and shows the algorithm, the standard claims, and whether the token has expired. The signature is shown as present or missing, but not checked.
What the results mean
- Algorithm
- How the token is signed, from the header. HS256 uses a shared secret; RS256 uses a public/private key pair.
- Expires (exp)
- When the token stops being valid. Shown as a date, and flagged if it is in the past.
- Signature: not verified
- The tool reads the signature but cannot check it without the key. Decoding a token proves nothing about its authenticity.
Frequently asked questions
Does decoding a JWT verify it?
No, and this is the single most important thing to understand. Decoding just Base64-decodes the header and payload, which anyone can do — the contents are not encrypted. What makes a JWT trustworthy is its signature, and verifying that requires the signing key. A decoder like this deliberately cannot verify, because it does not have your key and should never ask for it.
Is it safe to paste my token here?
The decoding happens in your browser with no network request, and this page blocks outbound connections. Even so, treat a real token as a live credential — its claims are readable to anyone who obtains it, so the safe habit is to decode test tokens, not production ones.