Does this verify the token's signature?

No. It only decodes the token so you can read its contents. Verifying a JWT requires the issuer's secret or public key, which should be done server-side. Never trust a token's claims based on decoding alone.

Is it safe to paste a real token here?

Decoding happens entirely in your browser and nothing is uploaded. Still, treat live access tokens as sensitive — anyone who sees a valid token may be able to use it until it expires.

Why can I read the payload without a password?

JWT payloads are only Base64URL-encoded, not encrypted. The signature protects against tampering, but the contents are readable by design, which is why you shouldn't store secrets in a JWT payload.

JWT Decoder

Decode a JSON Web Token to inspect its header, payload claims and expiry — without sending it anywhere.

What Is the JWT Decoder?

The JWT Decoder splits a JSON Web Token into its three parts and decodes the header and payload so you can read the claims in plain JSON. It highlights standard time claims (issued-at, not-before and expiry) in human-readable form and warns when a token has expired. It decodes only — it does not verify the signature — and runs entirely in your browser, so tokens are never transmitted.

How It Works

Paste a JWT (the long header.payload.signature string). The decoded header and payload appear instantly as formatted JSON, along with readable timestamps for any iat, nbf and exp claims. The signature is shown but not validated.

When to Use It

Use it to debug authentication flows, inspect what claims an access token carries, check a token's expiry, or understand a third-party API's token format during development.

Frequently Asked Questions

Does this verify the token's signature?: No. It only decodes the token so you can read its contents. Verifying a JWT requires the issuer's secret or public key, which should be done server-side. Never trust a token's claims based on decoding alone.
Is it safe to paste a real token here?: Decoding happens entirely in your browser and nothing is uploaded. Still, treat live access tokens as sensitive — anyone who sees a valid token may be able to use it until it expires.
Why can I read the payload without a password?: JWT payloads are only Base64URL-encoded, not encrypted. The signature protects against tampering, but the contents are readable by design, which is why you shouldn't store secrets in a JWT payload.

Last reviewed: 2026-06-27