JWT Decoder
Decode JSON Web Tokens and inspect the header, payload, and signature. Free online JWT decoder, no upload, browser-based.
Preparing private browser tool…
Frequently asked questions
- Does this tool verify the signature?
- No. It only decodes the header and payload (which are base64-url encoded JSON). Signature verification requires the server’s secret or public key, which we never ask for or store.
- Is it safe to paste a JWT here?
- The JWT never leaves your browser - parsing runs in pure JavaScript. Still, never paste production tokens from real users. Use development tokens or expired ones.
- What are the three parts of a JWT?
- Header (algorithm + token type), payload (claims like sub, iat, exp, custom data), and signature (HMAC or RSA signature over the first two parts).
- What does "exp" mean?
- The expiration time in Unix seconds. When the current time exceeds exp, the token is expired and should be rejected by the server.
- Why is base64url different from base64?
- JWT uses URL-safe base64: + replaced by -, / replaced by _, and padding = stripped. This makes tokens safe to include in URLs and headers.