Decode a JSON Web Token (JWT) to inspect its header and payload contents, entirely in your browser.
JSON Web Tokens (JWTs) are a widely used, compact format for representing claims securely between two parties, commonly used for authentication tokens, session identifiers, and API access tokens across countless modern web applications. This JWT Token Decoder lets you paste any JWT and instantly inspect its header and payload contents, entirely inside your browser, without ever sending the token to a server.
It's important to understand a key fact about JWTs from the start: by design, the header and payload portions of a standard JWT are not encrypted, they're simply encoded using Base64url, a URL-safe variant of Base64. This means anyone who has a copy of a JWT can decode and read its contents just as easily as this tool does, with no secret key required. The security of a JWT comes entirely from its signature, which cryptographically proves the token hasn't been tampered with since it was issued, not from the contents being hidden.
A JWT consists of three Base64url-encoded segments separated by periods: a header describing the token type and signing algorithm used, a payload containing the actual claims (such as a user ID, expiration time, or custom application data), and a signature that a server or client with the correct secret key can use to verify the first two segments haven't been altered. This tool decodes and displays the first two segments as readable JSON, while showing basic information about the signature segment without attempting to verify it.
Verifying a JWT's signature requires either the shared secret key (for symmetric algorithms like HS256) or the issuer's public key (for asymmetric algorithms like RS256), neither of which is available to this or any other generic client-side tool, and rightly so, since that key must remain confidential to whoever issued the token in order for the signature to mean anything. This tool is designed purely for inspection and debugging, letting you see what claims a token actually contains, not for confirming whether a token is genuinely valid or was issued by a trusted source.
Many JWTs include standard claims like "exp" (expiration time) and "iat" (issued at), both represented as Unix timestamps. This tool automatically converts these into human-readable dates and flags whether a token's expiration time has already passed, which is often the very first thing worth checking when debugging an authentication issue involving an unexpectedly rejected token.
This tool is especially useful when debugging authentication flows, inspecting what claims your own backend is actually issuing inside a token, or understanding the structure of a third-party API's access token during integration work. Because decoding happens entirely locally, it's safe to paste real tokens here during development and debugging, though as a general security habit, avoid pasting live production tokens containing sensitive claims into any website you don't fully trust and control.
The header's "alg" field typically shows either a symmetric algorithm like HS256, where the same secret key both signs and verifies the token, or an asymmetric algorithm like RS256, where a private key signs and a separate public key verifies. Recognizing which family a token uses is often the first useful clue when debugging why a particular verification step is failing on the backend.
Malformed or truncated tokens are one of the most common reasons decoding fails, often caused by a token being cut off during copy-paste or accidentally including surrounding whitespace or quotation marks. If decoding fails unexpectedly, double-check that you've copied the complete token starting from the very first character through the final signature segment.
No. Standard JWTs are only Base64url-encoded, not encrypted, so anyone with a copy of the token can read its header and payload contents, exactly as this tool does.
No. Signature verification requires the issuer's secret or public key, which no generic client-side tool has access to. This tool only decodes and displays the token's readable contents.
No. The entire decoding process happens locally in your browser using standard Base64url decoding and JSON parsing.
It's a standard JWT claim representing the token's expiration time as a Unix timestamp. This tool converts it to a readable date and flags whether it has already passed.
Since nothing is transmitted anywhere, it's technically safe here, but as a general habit avoid pasting live, sensitive tokens into any website you don't fully trust and control.
Idiot Security Tools