JWT Decoder

Decode a JWT to see what's inside

A JSON Web Token packs a header and a payload into a compact string used for authentication and sessions. The parts are Base64-encoded, not encrypted, so anyone holding the token can read its claims — which is often exactly what you need when debugging why a login or permission check behaves unexpectedly. This decoder splits a token and shows its header and payload as readable JSON.

How to use it

1. Paste a JWT (the three dot-separated parts).
2. Read the decoded header and payload.
3. Check claims like expiry, issuer, and subject against what you expected.

What to look for

• exp — the expiry time; an expired token is a common cause of sudden logouts.
• iss and aud — who issued the token and who it's for.
• The algorithm in the header, which tells you how it was signed.

Questions people ask

Does decoding verify the signature? No — decoding only reads the contents. Verifying authenticity requires the signing key, which stays on your server.

Is it safe to paste a token here? Decoding happens entirely in your browser, but treat real tokens as secrets and avoid pasting live ones you still rely on.