⚠

Decode only — this does not verify the signature. Anyone can read a JWT's header and payload without knowing the secret; that's by design (JWTs are signed, not encrypted). This tool tells you what a token claims, not whether it's authentic. Never trust a token's claims without verifying its signature server-side first.

Paste a JWT above to decode it.

How it works

A JWT is three base64url-encoded segments separated by dots: header.payload.signature. This tool base64url-decodes the header and payload and pretty-prints the resulting JSON — no cryptography involved in that part.
Standard time-based claims (iat, exp, nbf) are Unix timestamps — they're shown converted to a readable date, and exp gets an explicit "expired" / "valid" badge based on your device's current clock.
The signature segment is shown as raw base64url text only. Verifying it would require the signing secret or public key, which this tool never has (and shouldn't) — that check belongs on your server.
UTF-8 multi-byte characters in claim values (names, emoji, etc.) are decoded correctly — this isn't a naive atob() that would mangle them.

JWT Decoder

How it works