Runs locally in your browser
JWT Decoder
Inspect a JSON Web Token header, payload, and time claims in your browser. Decoding does not verify the signature or prove that the token is trustworthy.
✓ Decoded locally — signature not verified
What is inside a JWT?
A signed JWT normally has three period-separated segments: a header describing the signing algorithm, a payload containing claims, and a signature. The first two segments are Base64URL encoded and can be read without a secret key.
Decoding is not verification
Attackers can modify decoded claims or create an entirely new token. Verification must happen in trusted application code using an expected algorithm and signing key, followed by checks for issuer, audience, expiration, and other required claims.
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the readable Base64URL header and payload. Trust a token only after your application verifies its signature, algorithm, issuer, audience, and time claims.
Can a JWT payload contain secrets?
It should not. A normal signed JWT is encoded, not encrypted, so anyone who receives the token can decode its header and payload.
What do iat and exp mean?
iat is the issued-at time and exp is the expiration time. Both are NumericDate values measured in seconds since the Unix epoch.
Is my token sent to a server?
No. The token is decoded locally in your browser and is not included in the page URL.