JWT Decoder
Decode a JSON Web Token to read its header and payload — in your browser.
Reviewed by the ToolNestr Editorial Team — July 2026
Header
Paste a token above… Payload
Paste a token above… Signature
Paste a token above… Does not verify signature — never paste production secrets into any online tool.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe string that carries claims between two parties. It consists of three parts separated by dots: a header, a payload, and a signature. The header describes the signing algorithm and token type, the payload contains the claims (data), and the signature is calculated by combining the first two parts with a secret key to prevent tampering.
JWTs are commonly used for authentication (e.g. "I am logged in as user 42") and information exchange. Because the payload is only Base64-encoded — not encrypted — anyone who intercepts the token can read its contents. The signature protects against modification, not against reading.
How the JWT Decoder Works
The decoder takes a JWT string and splits it by the dot characters. The first segment (header) and second segment (payload) are Base64url-decoded and then parsed as JSON. The third segment (signature) is shown raw, since verifying it would require the signing key which is kept secret by the issuer.
This tool does not verify the signature, because verification needs the secret or public key. Decoding only lets you read the claims — it does not prove the token is authentic.
Worked Example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZXhwIjoxNzM1Njg5NjAwfQ.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U
After decoding, the payload shows { "sub": "1234567890", "exp": 1735689600 } and the exp field is displayed as Tuesday, January 1, 2025 at 12:00:00 AM UTC — a human-readable date.
Use Cases
- Debugging authentication tokens during development
- Checking token expiry and claims like issuer and subject
- Learning the structure and contents of JWTs
- Verifying that expected claims are present in a token
Tips & Common Mistakes
- Decoding is not verifying — anyone can read a JWT payload; it is signed, not encrypted.
- Never paste production tokens into any online tool — they may be logged or intercepted.
- The
alg: noneheader value means no signature; reject such tokens server-side.
Privacy & Security
This tool processes everything locally in your browser. No data is sent to any server, logged, or stored. The JWT you paste never leaves your device. You can verify this by opening your browser developer tools network tab — no network requests are made when you paste a token.
Related tools
Frequently asked questions
Is a JWT encrypted?
No — the payload is only Base64-encoded and readable by anyone; it is signed to prevent tampering, not to hide data.
Does this verify the signature?
No — it only decodes. Verification needs the secret/public key, done server-side.
Is my token uploaded?
No — decoding happens entirely in your browser.
Can I see my token expiry?
Yes — the exp claim (if present) is converted to a human-readable date automatically.