JWT Decoder — Inspect Token Header & Payload

Decoding a JWT is not verifying it

A JWT has three base64url-encoded segments: header, payload, and signature. The header and payload are encoded, not encrypted — anyone with the token can read every claim. This tool decodes and displays both. But decoding is not verification. Checking the signature requires the issuer's key. This tool shows the signature but does not verify it.

What you see when you decode a JWT

When you paste a JWT, this tool base64url-decodes each segment and displays the header and payload as JSON. The header contains the algorithm and token type. The payload contains user ID, roles, email, expiry time, and custom claims — all readable to anyone. Never store passwords, card numbers, or personal data in a JWT.

If the payload has exp (expiration time), the tool converts it to a readable date and flags whether the token is valid or expired. The iat (issued-at) timestamp is shown.

Why the payload is not secret

Developers assume the JWT payload is protected because it is used for authentication. It is not. Base64url encoding is for transport, not security. Anyone with the token can decode it in seconds.

Two critical consequences:

• Never put confidential data in a JWT payload.
• Never trust a decoded token for authorization. Anyone can craft a JWT claiming "role": "admin". Only server-side signature verification with the issuer's key proves a claim is real.

What this tool does and does not do

This tool decodes JWTs in your browser — no token leaves your device. It splits the token, decodes each segment, parses the JSON, and displays the results. Malformed tokens show an error. Expired tokens are flagged in red.

What it does not do: verify the signature, validate the issuer, check the key, or perform any cryptographic operation. To verify a JWT, use a library on your backend with the issuer's key. This tool is for inspection only. See the Base64 Decoder to understand why base64 is not encryption.