JWT Decoder

Reading what a JWT contains

A JSON Web Token looks like a long random string, but it is really three parts joined by dots: a header, a payload and a signature. The first two are Base64URL-encoded JSON, which means anyone can decode and read them. This tool does that and lays out the claims clearly, including the issue time, expiry time and subject, converted into readable dates.

Decoding is invaluable when debugging authentication. If an API rejects a request, checking the token often reveals the cause straight away: it may have expired, it may have been issued for a different audience, or it may be missing a role or permission your code expects. Comparing the expiry time with the current time also explains many 'works for a while, then fails' problems.

It is important to understand what decoding does not do. This tool does not verify the signature, so it cannot tell you whether a token is genuine or has been tampered with. Verification must always happen on your server with the correct secret or public key. Equally, because the payload is only encoded and not encrypted, never put passwords, card numbers or other secrets in a JWT, since anyone holding the token can read them. Treat tokens themselves as sensitive, because a valid token can be used to act as the user until it expires. That is why this decoder runs entirely in your browser and never sends the token anywhere. Avoid pasting real tokens into tools that work on a server. If a token looks wrong, ask the service that issued it for a fresh one rather than editing it.