About JWTs
A JSON Web Token (JWT) is a compact, self-contained way to carry information between two parties — most often to prove a user is logged in. It has three Base64URL parts separated by dots: the header (which algorithm signed it), the payload (the claims — user id, roles, expiry and so on), and the signature (which proves the first two parts weren’t tampered with). The header and payload are only encoded, not encrypted, so anyone can read them — which is exactly what this tool does.
How to decode a token
- Paste your JWT (it usually starts with
eyJ). - The header and payload are decoded and pretty-printed instantly.
- Issued-at and expiry times are shown in a readable format, with a note if the token has expired.
A note on security
Decoding is not the same as verifying. Because the payload isn’t encrypted, you should never put sensitive secrets inside a JWT. And you should never paste a signing secret or private key into any website to “verify” a token — verification belongs on your server.
Frequently asked questions
Does this verify the token? No — it only decodes. Verifying the signature needs the secret (HMAC) or public key (RSA/EC), which you should never paste into a website.
What do iat and exp mean? iat is when the token was issued and exp is when it expires — both as Unix timestamps, shown here as readable dates.
Is it private? Yes — the token is decoded entirely in your browser and never uploaded.