JWT Decoder
Decode a JWT into its header and payload - decoding only, signature is not verified.
How this tool works
Paste a JWT
The full token, including all three dot-separated segments.
Header and payload decode automatically
Each base64url segment is decoded into readable JSON side by side.
Check the timestamp claims
iat and exp are converted into human-readable dates so you can see if a token has expired.
Remember: decode only
A visible warning makes clear the signature isn’t verified - use this for reading claims, not trust decisions.
Quick facts
- Category
- Encoders & Decoders
- Best for
- Inspecting a JWT's claims while debugging an auth flow
About this tool
Paste a JWT to split it into its three dot-separated segments and base64url-decode the header and payload into readable JSON, with iat and exp claims additionally converted into human-readable UTC dates. This tool decodes only - it does not verify the signature, and it can’t, since checking a signature requires the secret key or public key the token was signed with, something a browser-based decoder never has access to. A successful decode here only proves the token is structurally a well-formed JWT with valid JSON in its header and payload; it says nothing about whether the token was actually issued by a trusted server or has since been tampered with. Never treat a token as authentic based on this tool - signature verification has to happen server-side with the correct key. Everything runs client-side, so pasted tokens never leave your browser.
Why use this tool
Both segments at once
Header and payload decode side by side - no need to split and decode each part manually.
Readable expiry dates
iat and exp convert from raw Unix timestamps into dates you can actually read at a glance.
Upfront about its limits
A visible warning states clearly that this decodes only and does not verify the signature.
Correct base64url handling
Properly converts the URL-safe character set and padding that plain base64 decoding would get wrong.
Frequently asked questions
No. Decoding a JWT and verifying it are two different operations - decoding just reads the base64url-encoded JSON out of the header and payload, which anyone can do without any secret. Verifying requires the signing key (a shared secret for HMAC algorithms, or the issuer’s public key for RSA/ECDSA), which this browser-based tool never has, so it can’t and doesn’t attempt to confirm the signature is valid.
The JWT spec uses base64url encoding for its segments specifically because standard base64’s "+" and "/" characters aren’t safe inside a URL without escaping. Base64url replaces them with "-" and "_" and omits padding, so this tool converts those characters back and restores the padding before running the result through standard base64 decoding.
JWTs encode iat (issued-at) and exp (expiration) as Unix timestamps - seconds since 1970 - which aren’t easy to read at a glance. This tool converts those two specific claims into a readable UTC date underneath the payload panel so you can quickly check whether a token has expired without doing the math yourself.
Explore more free tools
Formatters, converters, validators, and generators - all free and running entirely in your browser.
Browse more tools