About the JWT Decoder
A JSON Web Token (JWT) is a compact, Base64url-encoded string used everywhere in modern authentication systems to carry claims about a user or session between a client and a server. This JWT Decoder instantly splits a token into its three parts — header, payload and signature — and decodes the header and payload back into readable JSON so you can inspect exactly what information it contains.
This tool is essential for backend and frontend developers debugging authentication flows, QA engineers verifying that the correct claims (like roles or expiry) are present in a token, and security-conscious developers double-checking what data a third-party token actually exposes. Because JWT payloads are only encoded, not encrypted, this decoder works entirely offline in your browser — your token is never sent anywhere, which matters since tokens often carry sensitive session identifiers.
To use it, paste a full JWT (three Base64url segments separated by dots) into the input box. The tool immediately displays the decoded header (typically containing the algorithm and token type) and the decoded payload (containing claims like sub, iat, exp, and any custom fields your application added). If the token includes a standard "exp" (expiration) claim, the tool also shows a human-readable expiry date and whether the token is currently valid or already expired.
For example, pasting a typical token issued by an authentication provider reveals claims such as {"sub":"1234567890","name":"Ana","iat":1700000000,"exp":1700003600}, and the tool will show that the token expires at a specific date/time and whether that time has already passed relative to your current clock.
A critical point to understand: this tool decodes a JWT, it does not verify its signature. Anyone can decode a JWT's payload since it's just Base64url text — decoding never proves the token is authentic or untampered. To truly validate a token you must verify its signature server-side using the correct secret or public key. A common mistake is assuming a successfully decoded token is a "valid" token; always perform real signature verification in your backend authentication logic, and only use this decoder for debugging and inspection purposes, never as a substitute for actual verification in production code.
Tip: if decoding fails, double check you copied the entire token including all three dot-separated segments, since browsers sometimes truncate long strings when copying from address bars or logs.