JWT Decoder

About the JWT Decoder

A JSON Web Token (JWT) is the compact token format behind most modern login and API systems. It has three Base64URL-encoded parts separated by dots — the header (which algorithm signed it), the payload (the claims, such as who the user is and when the token expires) and the signature. This decoder splits the token and turns the header and payload back into readable, formatted JSON so you can see exactly what a token is carrying.

It also reads the standard time claims for you: iat (issued at), exp (expiry) and nbf (not before) are shown as human dates, so you can tell at a glance whether a token has expired or is not yet valid — one of the most common reasons an API call is rejected with a 401. That makes it a fast way to debug auth problems, inspect what a third-party service put in a token, or check the scopes and roles a token grants.

Two things matter for safety. First, decoding happens entirely in your browser — your token is never sent to any server, which is important because a live token is a credential. Second, this tool decodes but does not verify: it shows what is inside without checking the signature, so a decoded payload is not proof of anything and must always be verified on your backend before you trust it. To decode the raw parts by hand, see Base64 decode; to tidy the payload, use the JSON formatter.