JWT Decoder
Decode a JSON Web Token's header and payload without a server round-trip.
Last updated August 26, 2026
This decodes the token locally — it does not verify the signature against a secret.
About this tool
A JSON Web Token (JWT) is a compact, three-part token — header, payload, and signature, separated by dots — commonly used to carry authentication and session data in APIs. This tool decodes the header and payload (both are just Base64URL-encoded JSON, not encrypted) so you can inspect claims like expiry time or user ID without needing to verify or trust the token's signature.
Common JWT payload claims
| Claim | Meaning |
|---|---|
| iat | Issued at (Unix timestamp) |
| exp | Expiration time (Unix timestamp) |
| sub | Subject — usually the user ID |
| iss | Issuer of the token |
| aud | Intended audience/recipient |
Frequently asked questions
Does this tool verify the JWT's signature?
No — it only decodes the header and payload for inspection. Verifying a signature requires the secret or public key it was signed with, which this tool never asks for.
Is a JWT's payload encrypted?
No. The payload is only Base64URL-encoded, not encrypted, so anyone who has the token can read its contents — never put sensitive data like passwords directly in a JWT payload.
Is my token sent to a server to decode it?
No, decoding happens entirely client-side in your browser.