How jwt decoder works
A JSON Web Token (JWT) is a compact, URL-safe way to transmit information between parties. It has three parts separated by dots: a header (algorithm and token type), a payload (claims like user ID and expiry), and a signature. Each part is base64url-encoded.
This decoder splits the token, base64url-decodes the header and payload, and parses them as JSON. It shows the decoded header, the decoded payload with all claims, the signature, whether the token is expired, and the expiry and issue dates in human-readable form.
JWTs are not encrypted — they are encoded. Anyone can decode them, but only the server with the secret key can verify the signature. Never put secrets in a JWT payload. This tool only decodes; it does not verify signatures. All processing happens in your browser.
Frequently asked questions
What is a JWT?
A JSON Web Token (JWT) is a compact token with three parts: header, payload, and signature, separated by dots. It is used for authentication and information exchange. The header and payload are base64url-encoded JSON.
Can this tool verify JWT signatures?
No. This tool only decodes the header and payload. Verifying a signature requires the secret or public key, which is not embedded in the token. Decoding is safe to do client-side; verification should be done server-side.
Is it safe to decode a JWT?
Yes. JWTs are encoded, not encrypted. Anyone can decode them. The signature prevents tampering but does not hide the contents. Never put sensitive data like passwords in a JWT payload.
How do I check if a JWT is expired?
The decoder checks the exp claim in the payload and compares it to the current time. If the current time is past the expiry, the token is marked as expired. The expiry date is shown in readable form.
