About this tool
Why it exists.
A JSON Web Token is three Base64URL segments separated by dots: header, payload and signature. Everything except the signature is readable by anyone holding the token. This decoder shows the header and claims in plain JSON and translates registered time claims into readable dates.
Decoding is not verification. The signature is checked with a secret or public key, and this browser-only tool has no access to your key, so it cannot tell you whether the token is authentic. It will tell you when the token expires and whether the expected claims are present.
How to use it.
- Paste a JWT into the input field.
- Read the decoded header, payload and time-based claims.
- Copy the payload if needed, then clear the token from the page.
Good questions.
Does this tool verify the JWT signature?
No. It only decodes the two JSON segments. Signature verification requires the issuer's secret or public key. Never treat a decoded-but-unverified token as trustworthy.
Why is my token shown as invalid?
A JWT needs three dot-separated Base64URL segments. Extra whitespace, a missing signature segment or a token copied from a log with line wrapping will break decoding. Ensure you copied the complete value.
Is it safe to paste a token here?
The token is decoded locally and is not sent over the network. But a real token is a credential. Avoid pasting production tokens into any browser tool on a shared computer, and revoke anything you accidentally expose.