JWT Decoder
Paste a JSON Web Token to see its header, claims, and expiry — color-matched to each segment of the raw token.
Runs entirely in your browser — nothing you enter leaves this page
Header
Payload
Signature
This tool does not verify the signature — it only decodes. Never trust a token's claims until your server has verified the signature against the signing key.
What this shows you
A JWT is three base64url-encoded segments separated by dots:
header.payload.signature.
The decoder above splits the token, decodes the first two segments into
JSON, and highlights time-based claims like exp and
iat with human-readable dates. The colors in the raw token
match the decoded panels, so you can see exactly which bytes carry what.
Is it safe to paste a real token here?
The page runs entirely in your browser — there is no network request, no analytics on the input, and nothing stored. That said, treat production tokens like passwords: prefer decoding expired or development tokens, and rotate any secret you suspect has leaked.
Why is the payload readable without the secret?
Base64url is an encoding, not encryption. Anyone holding a JWT can read
its claims; the signature only proves the token wasn't altered. That's why
you should never put sensitive data in a JWT payload — a mistake we cover
in depth in our explainer,
What is a JWT?, alongside the
alg-confusion and storage pitfalls that actually get apps
compromised. For how tokens fit into login flows, see
What is OAuth 2.0?.