JWT Decoder

A JWT is three base64url-encoded segments separated by dots: header.payload.signature. The header describes the token type and signing algorithm (e.g. HS256), the payload holds the claims (the actual data), and the signature is a cryptographic hash used to verify the header and payload haven't been tampered with.

No. This tool only decodes the header and payload so you can read their contents — it does not check the signature against a secret or public key, so it can't tell you whether the token is genuine or has been tampered with. Verifying a signature requires the same secret (or public key) that was used to sign it, which this tool never has.

Decoding happens entirely in your browser using JavaScript — the token is never sent to a server or logged anywhere. That said, JWTs are just base64-encoded, not encrypted, so anyone who has the token can already read its claims. As general good practice, avoid pasting tokens containing sensitive data into any online tool, even client-side ones.

These are common registered claims: exp is the expiration time (Unix timestamp, in seconds), iat is when the token was issued, sub identifies the subject the token refers to (usually a user ID), and iss identifies who issued the token. None of these are required by the JWT spec, but most authentication systems include them.

Because the header and payload are only encoded, not encrypted or protected from viewing, anyone can decode and read them — including modifying the values in a copy of the token. Only verifying the signature server-side, with the correct secret or public key, proves the token actually came from a trusted issuer and hasn't been altered.