About this tool
A JWT (JSON Web Token) is a compact token format made of three dot-separated Base64URL strings: header.payload.signature. The first two are the header (which describes the algorithm) and the payload (which carries the claims); both are merely Base64URL-encoded, not encrypted. The third part, the signature, is used to verify the token has not been tampered with. This tool decodes the header and payload into readable JSON and helps you read common claims like exp (expiry), iat and sub.
Security is the core point of this tool: decoding happens entirely in your browser, and the token is never sent to any server. That matters — a JWT is often equivalent to a login credential, so pasting it into an online tool that uploads it is the same as leaking your identity. Here you can inspect a token's contents safely.
How to use
- Paste the full JWT into the input box; it should contain two dots, in the form xxx.yyy.zzz.
- The tool immediately Base64URL-decodes the header and payload into JSON and shows them in separate sections.
- Read the claims in the payload, paying attention to whether exp has expired and whether iss/aud match expectations.
- Copy the decoded JSON if you need it for troubleshooting.
- The whole process is offline with no upload; the input is discarded once you close the page.
When to use it
- See exactly what user info and permissions a token carries while debugging an auth session.
- Diagnose "logged in but getting unauthorized" — often the exp claim has expired.
- Check that frontend and backend agree on the names and values of claim fields.
- See the real contents of the header and payload when learning how JWTs are structured.
- Safely inspect a suspicious or third-party token without verifying its signature.
FAQ
Will my token be sent to a server?
Absolutely not. Decoding happens entirely in your browser; the token is never uploaded, logged or stored. Since a JWT often equals a login credential, this is essential for security.
Does it verify the token signature?
No. It only decodes the header and payload for inspection. Verifying the signature requires a key and should be done server-side. The decoded claims are informational and do not prove the token is valid.
Is the JWT payload encrypted?
By default, no. The payload is only Base64URL-encoded and anyone can decode and read it. So do not put sensitive plaintext in a JWT — the signature guarantees integrity, not confidentiality.
How do I tell if a token has expired?
Check the exp claim in the payload — it is a Unix timestamp; if it is earlier than now, the token has expired. The iat and nbf claims also relate to timing checks.