JWT decoder

A JSON Web Token is three Base64Url-encoded segments separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. The header and payload are only encoded, not encrypted, so anyone holding the token can read them. This tool decodes both instantly. The format is defined in RFC 7519.

What can I see when I paste a token in?

Paste a token to see its header and payload as formatted JSON, plus a plain-language note for any time-based claim it contains. The header typically names the signing algorithm (alg) and token type. The payload holds whatever claims the issuer put there: standard ones like issuer (iss), subject (sub), audience (aud), expiry (exp), issued-at (iat), not-before (nbf), plus any custom claims your provider adds, such as roles or scopes. For exp, iat, and nbf, the tool also converts the Unix timestamp to a readable date and tells you whether the token is expired or not yet valid, which is usually the fastest way to figure out why an API rejected it. A token needs exactly three dot-separated parts and valid Base64Url-encoded JSON in the first two to decode; anything else is reported as an invalid JWT.

Is my token sent anywhere?

No. Decoding happens entirely in your browser: the token is parsed and split apart locally, and nothing is transmitted over the network. That makes it safe to paste real access tokens, including ones from a production system, without worrying about them passing through a third party.

Does this tool verify the signature?

No, and this matters. The tool only decodes the header and payload, which is just Base64Url decoding followed by a JSON parse. It does not check the signature, so it can’t tell you whether a token is genuine or was tampered with. Decoding shows you what a token claims; verifying proves those claims are trustworthy, and that check has to happen against the issuer’s signing key, normally on a server or in a backend library that has access to it. If you’re debugging a rejected token, decoding here is a fast way to see if the claims look right, but a passing decode is not the same as a valid signature.

For background on how the three segments fit together and what each standard claim means, Auth0’s JWT introduction is a useful reference alongside the RFC.