JWT Decoder

A JWT (JSON Web Token) is a compact, URL-safe token used to carry claims between two parties, most often for authentication and authorization. Every JWT has three Base64url-encoded parts separated by dots: a header that names the signing algorithm, a payload that holds the claims (such as the subject, issued-at time, and expiry), and a signature. This JWT decoder splits the token and shows you the decoded header and payload as readable, pretty-printed JSON.

Decoding a JWT is not the same as verifying it. The first two segments are only Base64url-encoded, not encrypted, so anyone can read them — that is exactly what this tool does. It deliberately does not check the signature, which means you do not need to paste any secret or key. Because all of the work happens locally in your browser with JavaScript, your token never leaves your device and is never logged or stored. That makes it safe to inspect real production tokens while you debug.

Developers reach for a JWT decoder constantly: confirming which claims an auth provider actually issued, checking the `exp` and `iat` timestamps when a session expires unexpectedly, or reading the `alg` in the header during a security review. Paste the full `header.payload.signature` string and the decoded claims appear immediately. If the token is malformed or the segments are not valid Base64url JSON, the tool shows a clear error instead of returning garbage.