JWT Decoder
Paste a JSON Web Token below to read its header and payload in plain JSON.
This tool decodes only — it does NOT verify the signature. Verification needs the secret key, which this tool never asks for. Anyone can read a JWT’s header and payload without the secret, so never put secrets or passwords inside a token.
Nothing you type is saved or sent anywhere — everything stays in your browser.
How to use this JWT decoder
This JWT decoder reads a JSON Web Token and shows its header and payload in plain, readable JSON. It does not need an account, and nothing you paste is saved or sent anywhere — everything happens in your browser.
Step 1: Paste your token into the box above. You can also press the "Try a sample token" button to fill in a ready-made example and see how a real token looks when decoded.
Step 2: Press "Decode token", or just start typing — the decoder reads the token as you paste it. The header appears first, then the payload, then the signature as it was pasted, marked "shown, not checked".
Step 3: Read the dates. When the payload has an iat claim, the decoder shows when the token was issued as a readable date and time in UTC. When it has an exp claim, it shows when the token expires, and tells you whether it is still valid or already expired.
Worked example
Take the sample token, which has the usual three parts separated by dots. The first part decodes to the header {"alg": "HS256", "typ": "JWT"}, which says the token uses the HS256 signing algorithm and is a JWT. The second part decodes to the payload {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}: the subject is the user 1234567890, the name is John Doe, and the issued-at time is 18 January 2018, 01:30:22 UTC. The third part is the signature, which the decoder shows exactly as it is, with the note "shown, not checked" — the tool never tries to verify it.
What the three parts are
A JWT is three strings joined by dots. The first is the header, a small piece of JSON that says what kind of token it is and which signing algorithm was used. The second is the payload, also JSON, carrying the claims — statements about a user, a session, or anything else the issuer wanted to record, such as who the token is for (sub), when it was issued (iat), and when it expires (exp). The third is the signature, which the issuer creates from the first two parts and a secret key, so the receiver can check that nothing on the token was changed after it was issued.
The header and payload are base64url-encoded JSON, which is why a token looks like a string of random letters. Anyone can decode those two parts and read them — no secret is needed to do that. That is exactly what this decoder does. The signature is different: checking it needs the secret key, and only the party that issued or verifies the token should have it.
This tool decodes only — it does NOT verify the signature. Verification needs the secret key, which this tool never asks for. If a token matters, verify its signature on a server or with the service that issued it, with the real key, before you trust it.
What NOT to put in a token
Never put secrets or passwords inside a token. Because anyone can read the header and payload without the secret, anything in the payload is effectively public to whoever receives the token. Keep payloads to the identifiers and claims a system actually needs — a user ID, a name, an expiry time — and never put passwords, API keys, credit card details, or other sensitive data in a token. If you are not sure whether something is safe to include, leave it out and fetch it from your server instead.
Frequently asked questions
What is a JWT?
A JWT, or JSON Web Token, is a compact way to pass claims between two parties, usually to prove who someone is after they sign in. It is three strings joined by dots: a header, a payload, and a signature. The header and payload are base64url-encoded JSON, and the signature is made from those two parts and a secret key.
Does this tool verify the signature?
No — this tool decodes only. It reads the header and payload and shows the signature as it is, marked "shown, not checked". Verification needs the secret key, which this tool never asks for. To check a signature, use the service that issued the token, with the real key.
Is my token sent anywhere?
No — everything happens in your browser, and nothing you paste is uploaded or saved. You can use the decoder with tokens that matter to you, but remember that anyone who receives a token can read its header and payload, so never put secrets or passwords inside one.
What is in the payload?
The payload carries claims: statements about the token and its subject. Common claims are sub (the subject, usually a user ID), name, iat (when the token was issued), and exp (when it expires). A payload can also carry other claims the issuer chose to add, such as roles or permissions.
Why does the token look like random letters?
Because the header and payload are base64url-encoded JSON. Encoding turns the JSON into a compact string of letters, numbers, and a few symbols that can travel safely in a URL or a request header. The decoder reverses that encoding to show you the original JSON, and the signature is a separate encoded string on top of it.