JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64URL parts separated by dots: a header (algorithm and type), a payload (the claims/data), and a signature (which verifies integrity). The header and payload are encoded, not encrypted, so anyone can read them.

Common payload claims include iss (issuer), sub (subject), aud (audience), iat (issued at) and exp (expiry). Decoding reveals these; verifying the signature — which requires the secret or public key — is what proves the token is authentic.

The JWT Decoder instantly decodes a JSON Web Token into its readable header and payload, and breaks out the standard claims — issuer, subject, audience, issued-at and expiry — with human-readable dates. Paste a token to see exactly what it contains while debugging authentication.

JWTs are the backbone of modern auth: APIs, single sign-on and session tokens all use them. When a request is rejected or a session expires unexpectedly, decoding the token is the fastest way to see the claims and check the expiry. This tool makes that a one-paste operation.

Decoding happens entirely in your browser, so tokens are never sent to a server. Note that this tool decodes tokens for inspection — it does not verify the signature, so never trust a token's contents without server-side verification.