JWT Decoder

How this tool works

Paste a JWT and click Decode. The token's three dot-separated parts — header, payload, and signature — are split apart; the header and payload (both just Base64URL-encoded JSON) are decoded and shown formatted, and if the payload has an exp claim, this tool tells you whether the token has expired.

Header, payload, and signature — what each part means

The header typically names the signing algorithm and token type. The payload holds the actual claims — who the token represents, when it was issued, when it expires, and any custom data the issuer added. The signature is what makes the token trustworthy: it's a cryptographic proof that the header and payload haven't been tampered with, verifiable only by whoever holds the signing key — which is exactly why this tool doesn't attempt to verify it.

Privacy by design

Decoding happens entirely in your browser using standard Base64URL and JSON parsing. Nothing you paste is sent to a server or logged.