Decode a JWT online
This tool decodes the token — it does not verify the signature.
Paste a JWT (JSON Web Token) to instantly see its decoded header and payload as formatted JSON. This tool decodes only — it does not verify the signature, since that requires the secret or public key the token was signed with. Everything runs in your browser; nothing you paste is sent anywhere.
Three parts, two of them readable
A JWT is three Base64url segments separated by dots: header, payload, and signature. The header and payload are merely encoded, not encrypted, so anyone holding the token can read them — which is exactly what this tool does. The signature is the only part providing security, and verifying it requires the secret or public key the token was signed with.
Decoding is safe, trusting is not
Reading a token's contents requires no key and reveals nothing that the token holder did not already have. What you must not do is trust those contents without verifying the signature server-side — anyone can craft a token claiming to be an administrator, and it will decode perfectly happily. Decoding tells you what a token claims; only signature verification tells you whether the claim is genuine.
Fields worth checking
The payload usually carries exp, an expiry timestamp in Unix seconds — a token that has stopped working is very often simply past it. iat records when the token was issued, sub identifies the subject, and iss names the issuer. When debugging an authentication failure, exp is the first field to check and the timestamp converter will turn it into a readable date.
Frequently asked questions
- Does this verify the token's signature?
- No, this only decodes the header and payload, which is safe to do without the signing key. Verifying the signature requires that key, which this tool never asks for or needs.
- Is it safe to paste a real token here?
- Decoding happens entirely in your browser and nothing is transmitted, but as a general rule avoid pasting production secrets into any web tool — use a test/expired token when possible.
- What if my token is malformed?
- You'll see a clear error rather than incorrect or partial output.
- Does this verify the signature?
- No, and it does not need your key. It decodes the header and payload only — signature verification must happen server-side with the signing key.
- My token stopped working. How do I check why?
- Decode it and look at the exp field, which is a Unix timestamp for expiry. Paste that number into the timestamp converter to read it as a date — an expired token is by far the most common cause.