JWT Decoder
Decode and inspect JSON Web Tokens — your token never leaves the browser
JWT Token
About JWT Decoder
A JSON Web Token (JWT) is a compact string used to carry claims between systems, most often as a login or API access token. It has three Base64URL-encoded parts separated by dots: a header describing the algorithm, a payload containing the claims, and a signature.
The decoder splits the token, decodes the header and payload, and shows the claims in readable form, including issue and expiry times when they are present. Decoding only reads the token; it does not prove the token is authentic. Verifying the signature requires the issuer's secret or public key.
Common use cases
- Checking which scopes, roles, or user ID a token carries while debugging authorization.
- Finding out whether a token has expired and when it was issued.
- Confirming which signing algorithm a token declares in its header.
- Comparing tokens from different environments during integration testing.
Frequently asked questions
- Can this tool verify a JWT signature?
- It decodes and inspects tokens. Trust decisions must always be made by your server, which checks the signature with the correct key.
- Is a JWT payload encrypted?
- A standard signed JWT is only encoded, not encrypted, so anyone holding the token can read its claims. Do not put secrets in the payload.
- Should I paste a live production token?
- The token is decoded in your browser and not uploaded, but treat live tokens with care and prefer short-lived or test tokens when possible.