JWT Decoder

What a JSON Web Token contains

A JWT is three Base64URL-encoded sections separated by dots: header.payload.signature. The header says which algorithm was used, the payload carries claims such as who the user is and when the token expires, and the signature lets a server confirm the token has not been altered. This tool splits the token at the dots, decodes the header and payload and shows each as indented JSON.

Common claims you will see

Times such as exp are shown as raw numbers. To read one, convert it from Unix seconds to a date: for example, 1767225600 is 1 January 2026 at 00:00 UTC.

What decoding does not do

• It does not verify the signature. A decoded token can look perfectly valid even if it was forged. Verification needs the secret or public key and must happen on your server.
• It does not check expiry for you. Compare exp to the current time yourself.
• It does not decrypt. Encrypted tokens (JWE) cannot be read; only the common signed format (JWS) is decodable.

Why anyone can read a JWT

The payload is only encoded, not encrypted. Do not put passwords, card numbers or other secrets inside a token's claims, and treat tokens themselves as credentials: anyone holding a valid one can act as that user until it expires.

Debugging checklist

1. Is the token exactly three dot-separated parts? Otherwise this tool reports it as invalid.
2. Has it expired, or is its nbf still in the future?
3. Do iss and aud match what your API expects?
4. Does the header's alg match the algorithm your server accepts? Reject none.
5. Is there a copy-and-paste problem such as a trailing space, line break or missing character?

Because decoding happens locally, the token is not sent anywhere, but avoid pasting live production tokens into any web page. Related: Base64 decoder and JSON formatter.