JWT Decoder — Decode a Token Online
Decode a JWT: header and payload in readable form. The signature is not verified and data never leaves your browser.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}The JWT decoder breaks a token into its parts and shows its contents. A JWT (JSON Web Token) consists of three dot-separated parts — header, payload and signature — where the first two are Base64URL-encoded. Paste in a token and the tool displays the header and payload as formatted JSON, converting timestamps (iat, exp, nbf) into readable dates.
This is invaluable when debugging authorization: you can see exactly what data and permissions are baked into a token, whether it has expired (exp), and who issued it. It's important to understand that the decoder only reads the contents and does NOT verify the signature — verification requires a secret key that should never end up in a browser. So don't paste live production tokens in here.
Parsing happens entirely locally in your browser; the token is never sent anywhere.