JWT Decoder
Inspect JWT headers, claims and expiry.
What is the JWT Decoder?
A JWT decoder splits a JSON Web Token into its three dot-separated parts and Base64-decodes the header and payload so you can read the claims — who issued it, who it is for, and when it expires. Decoding needs no key, because a JWT payload is signed, not encrypted.
Frequently asked questions
Is it safe to paste a real access token into a JWT decoder?
Only into one that decodes locally, as this does — the token never leaves your browser. Be genuinely careful elsewhere: a JWT is a bearer credential, so pasting a live one into a server-side decoder hands over whatever access it grants until it expires.
Does decoding a JWT verify that it is valid?
No. Decoding just reads the payload; anyone can do that and anyone can craft a token with any claims they like. Only verifying the signature against the issuer's key proves a token is genuine, and that must happen on your server.
Why can everyone read what is inside my JWT?
Because the payload is Base64-encoded, not encrypted. The signature stops it being modified, not read. Never put anything confidential in a JWT claim — assume the client and anyone who intercepts the token can see all of it.
Related Encoders & Decoders
- Base64 Encode/DecodeConvert text and files to and from Base64.
- HTML Encoder/DecoderEscape and unescape HTML entities.
- URL Encoder/DecoderPercent-encode and decode URLs and query strings.
JWT Decoder is one of 4 tools in Encoders & Decoders on Toolkit Hub, a free collection of browser-based utilities. It requires no account and no installation. Browse all tools.