JWT Decoder
About JWT Decoder
Paste a JSON Web Token and instantly decode its three Base64 segments into readable JSON — the header (algorithm and token type), the payload (claims like issuer, subject, expiration, and roles), and the signature. The inspector flags missing or malformed segments and highlights the expiration and issued-at claims so you can tell at a glance whether a token is well-formed and still valid. Decoding runs entirely in your browser, so you can safely paste real tokens during debugging.
How To Use
- Paste your JWT into the input.
- The tool decodes the header and payload segments from Base64 into readable JSON.
- Inspect the claims — especially exp (expiration) and iat (issued at) — to confirm the token is well-formed and current.
Example
Input: An opaque-looking JWT string of three Base64 segments separated by dots.
Output: The decoded header showing the signing algorithm, and the payload showing the user ID, issuer, and expiration timestamp.
Who Uses JWT Decoder
- Developers who prefer private, browser-only tools for formatting, validation, and data work.
- Engineers who need fast local tools without installing anything or uploading code.
- Teams that want private — files and text stay on your device and are never uploaded to a server.
Frequently Asked Questions
Can this validate a JWT signature?
No. This tool decodes the header and payload but does not cryptographically verify the signature, since that requires the secret or public key. Use it to inspect token contents, not to trust them.
What claims should I check?
Common claims to inspect are iss (issuer), sub (subject), aud (audience), exp (expiration), and iat (issued at). If exp has passed, the token is no longer valid.
Is my token uploaded anywhere?
No. Decoding runs entirely in your browser. That said, avoid pasting highly sensitive production tokens into any online tool — strip or redact them first when possible.
Why does my decoded payload show [object] or strange characters?
JWT payloads are Base64URL-encoded JSON. This decoder handles the encoding correctly, so if output looks wrong the token itself may be malformed or truncated.