How to use the JWT decoder
- Paste the full token — the three dot-separated parts.
- The header and payload are decoded and pretty-printed instantly.
- Standard claims like
expandiatare translated into readable dates, with an expiry check.
What the three parts mean
A JWT is three Base64URL-encoded sections separated by dots: header.payload.signature. The header says which algorithm signed it. The payload holds the claims — who the user is, when the token expires, what they're allowed to do. The signature is a cryptographic seal that proves the first two parts haven't been altered by anyone without the secret key.
Decoding is not verifying
This is an important distinction. Anyone can decode a JWT — the payload is encoded, not encrypted, so it's readable by design. What you cannot do without the signing secret is verify it or forge a valid one. That's why you must never put passwords, card numbers or other secrets in a JWT payload, and why verification must always happen server-side, never in the browser.
Benefits
- Decodes a JWT’s header and payload into readable, pretty-printed JSON.
- Converts exp, iat and nbf claims into real dates and flags expired tokens.
- Runs entirely in your browser — your token is never uploaded.
- Clear about what it does not do: it decodes, it does not verify signatures.
Limitations to know
- It does not verify the signature — that needs the signing key, which you should never paste online.
- It cannot decrypt encrypted (JWE) tokens.
- A malformed or truncated token will fail to decode.
Common mistakes to avoid
- Assuming a decoded token is a valid token — decoding proves nothing about authenticity.
- Putting secrets in a JWT payload; payloads are only Base64url-encoded, not encrypted.
- Pasting a signing secret into any online tool — never do that.
Alternatives
To decode plain Base64 use the Base64 Encoder; to tidy the decoded JSON use the JSON Formatter.
Last updated: August 2026 · Reviewed by the AI Toolbox editorial team.
Frequently asked questions
Is my token sent to a server?
No. Decoding runs in your browser using built-in Base64 functions — the token never leaves your device.
Can this verify the signature?
No, and no browser tool safely should — verification needs the signing secret, which must stay on your server.
Why does my token look like gibberish?
It's Base64URL-encoded, not encrypted. Pasting it here converts it back into readable JSON.
What does "exp" mean?
Expiry — a Unix timestamp after which the token should be rejected. This tool converts it to a readable date and flags expired tokens.