Paste a JSON Web Token into the box; its header and payload claims decode to readable JSON below, right in this browser tab.
A JWT has three dot-separated parts: a header naming the signing algorithm and token type, a payload carrying the claims (subject, issued-at, expiry, and any custom fields an issuer adds), and a signature. This tool decodes the first two parts and prints the third as-is; it does not check whether the signature is genuine.
If your string has only one part, or fails to decode as JSON once split, it is not a JWT - a plain base64 string, a percent-encoded URL, or a JSON blob will not decode here.
JWT Decoder
JWT Decoder splits a JSON Web Token into its three parts and decodes the header and payload back to readable JSON, so you can see exactly what claims a token carries.
Paste a token to check its algorithm, subject, issued-at time, and expiry (the exp claim) without leaving your browser.
Key features
- Decodes the base64url header and payload back to readable JSON and pretty-prints both.
- Splits the token on its dots and requires exactly three parts, otherwise it returns a plain "Not a JWT" message.
- Surfaces the exp and iat claims as readable timestamps and flags an expired token.
- Shows the signature segment as raw text, clearly labelled as shown but not verified.
- Names exactly which piece failed on invalid input - too few segments, or a part that will not base64url-decode - instead of failing silently.
Decoding a token in three steps
JWT Decoder runs in three moves: open the tool, paste the token, read the decoded result. Nothing is installed and nothing is signed in first.
- Open JWT Decoder on this page.
- Paste the full token - the three dot-separated segments (header, payload, signature). A token missing a segment, or carrying a segment that is not valid base64url JSON, comes back as a plain error in the output pane rather than breaking the page.
- Read the result on the same page: pretty-printed header and payload JSON, with exp and iat shown as readable timestamps and an already-past exp marked EXPIRED.
When to use it
- Debugging an API login.
- Inspecting a token a colleague sent you.
- Checking why a session expired.
Privacy and data handling
Decoding runs locally in this browser tab, with no upload and no account. Verifying the signature needs the issuer's secret or public key, which never leaves the server, so this tool reads structure rather than authenticity.
Use the URL Decoder instead when your text is a plain percent-encoded string rather than a three-part token.
Frequently Asked Questions
What does JWT Decoder do?
It splits a JSON Web Token on its dots and decodes the header and payload segments back to readable JSON, so you can read the claims a token carries (algorithm, subject, issued-at, expiry).
Does this verify the signature?
No. The signature segment is shown as raw text but is not checked, since verifying it needs the issuer's secret or public key, which never leaves the server. This tool decodes structure, not authenticity.
What's the difference between this and the URL Decoder?
URL Decoder percent-decodes a plain string (like a query-string value). JWT Decoder expects a three-part token and decodes each part as JSON. Use URL Decoder when your text is not a token.