JWT Decoder
Free JWT decoder. Paste a JSON Web Token to see its header and payload — decoded entirely in your browser, signature not verified.
Frequently asked questions
What are the three parts of a JWT?
A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature. The header names the signing algorithm and token type. The payload holds the actual claims — data like a user ID, issued-at time, or expiry. The signature is a cryptographic value proving the header and payload haven't been altered since signing, computed with a secret or private key only the issuer holds.
Why can't this tool verify the signature?
Verifying a signature requires the issuer's secret (for HMAC algorithms) or public key (for RSA/ECDSA algorithms) — something only the system that issued the token has, by design. This tool can only decode the header and payload, which is just Base64URL decoding plus a JSON parse; it tells you nothing about whether the token is genuine or has been tampered with.
Is it safe to decode a JWT here?
Decoding happens entirely in your browser using standard Base64URL decoding — the token is never sent anywhere. That said, a JWT payload can contain sensitive claims, so treat any token the same way you'd treat a password: avoid pasting one you don't control into any tool, this one included, if you're not sure what it contains.
What are common claims like exp, iat, and nbf?
These are standard registered claim names: exp is the expiry time (the token should be rejected after this), iat is when the token was issued, and nbf ("not before") is the earliest time the token becomes valid. All three are Unix timestamps in seconds.