Is it safe to paste a real token here?

Decoding happens entirely in your browser and nothing is transmitted or logged. That said, a live token is a credential — if it is a production token, treat it carefully and rotate it if you have any doubt about where it has been pasted.

Does this verify the signature?

No. Verification requires the secret or public key and must be done server-side. This tool shows what the token claims; it cannot tell you whether the claims are authentic or the token has been tampered with.

Why can anyone read the payload?

Because JWTs are signed, not encrypted. The signature guarantees the contents have not been altered — it does not hide them. Never put passwords or personal data in a JWT payload.

What do exp and iat mean?

exp is the expiry time and iat is the issued-at time, both as Unix timestamps in seconds. Use the Unix Timestamp Converter to turn them into readable dates — an expired exp is the most common reason a token is rejected.

Encode & Decode

JWT Decoder

A JWT has three Base64-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. This decoder shows the first two so you can inspect what a token actually contains.

Free, no signupRuns entirely in your browser

Input

JWT Token String

Result

Paste a token to inspect.

About

What the JWT Decoder does

Two things are essential to understand. First, a JWT payload is encoded, not encrypted — anyone holding the token can read every claim in it, so never put secrets in one. Second, this tool does not verify the signature; that requires the signing key and must happen on your server. Decoding tells you what a token claims, not whether those claims are genuine.

How it works

Using the JWT Decoder

1Paste the complete token, including all three dot-separated parts.
2The token is split on the dots.
3The header and payload are Base64URL-decoded and parsed as JSON.
4Both are displayed as formatted, readable objects.
5The signature is reported by length only, since verifying it requires the key.

Use cases

What people use it for

Checking which claims an auth token carries
Debugging why a token is being rejected as expired
Confirming the issuer and audience on an integration
Inspecting the algorithm a token was signed with

FAQ

Frequently asked questions

6 related

Related tools

All tools →

Encode & Decode

Base64 Converter

Convert text or files to/from Base64 encoding.

Runs in your browser

Encode & Decode

URL Encoder / Decoder

Encode strings into URL-safe formats or decode percent-encoded URLs.

Runs in your browser

Encode & Decode

HTML Entity Encoder / Decoder

Encode characters into HTML entities (e.g. <) to prevent rendering bugs.

Runs in your browser

Encode & Decode

Morse Code Converter

Encode text to Morse code signals or decode Morse signals to text.

Runs in your browser

Encode & Decode

Caesar Cipher

Encrypt or decrypt strings using simple modular alphabet shifting.

Runs in your browser

Encode & Decode

ROT13 Cipher

Rotate letters by 13 positions in the alphabet to encode or decode text strings.

Runs in your browser