JWT Decoder - Decode JSON Web Tokens Online
AdSense Placeholder
Slot: header_tool
JWT Decoder
Decode JSON Web Tokens Locally
Header JSON will appear here
Payload JSON will appear here
Signature will appear here
Error
Please paste a valid JWT.
AdSense Placeholder
Slot: tool_mid_article
Understanding JSON Web Tokens
Three Parts
A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature.
Header
Declares the signing algorithm (alg) and token type (typ), typically JWT.
Payload
Holds the claims — data about the user or token, such as sub, exp, and custom fields.
Local Processing
Decoding happens entirely in your browser — your token is never transmitted anywhere.
Decoding Is Not Verifying
Anyone can decode a JWT's header and payload — they are only Base64URL-encoded, not encrypted. This tool reads that data for debugging, but it does not verify the signature. A token's claims cannot be trusted as authentic until the signature has been cryptographically verified against the issuer's secret or public key on the server.
Key Takeaways
- Not Encrypted: The header and payload are readable by anyone with the token — never put secrets in them.
- exp Claim: The optional
expclaim is a Unix timestamp marking when the token expires. - Client-Side Only: Your token is decoded locally and never sent to a server.