JWT Decoder

Paste a JSON Web Token to see its header and payload. Decoding is not verification: the signature is never checked here, and nothing leaves your tab.

Token

Header

Payload

Registered claims

Signature

Notes

A JWT has three base64url segments: header, payload, signature. This page decodes the first two and shows the third untouched.
Anyone can craft a token with any payload. Only a server that verifies the signature can trust one, so do not decide permissions from what you read here.
Pasted tokens are bearer credentials. If a token is still valid and was not yours to read, treat it as leaked.

What this JWT decoder does

A JSON Web Token is three base64url strings joined by dots: a header describing the algorithm, a payload holding the claims, and a signature over the first two. This page decodes the header and payload and prints the signature as-is, so you can read what a service sent you without pasting a login token into a stranger's server.

Timestamp claims get the most use. Expiry, issued-at and not-before are Unix seconds, which are unpleasant to read, so they are shown both as ISO time and as your local time. If the token is expired the page says so; if it is not, that only means the clock agrees, not that the token is valid.

This is a decoder, not a verifier. Anyone can produce a token with any payload and any fake algorithm name, so never grant access on the basis of what you read here. Verification needs the issuer's secret or public key, and that step belongs on the server.

Need a tool that is not here? Ask for one.