Quick Answer
How do you decode a JWT?
// Answer
A JSON Web Token has three Base64URL-encoded parts separated by dots: header.payload.signature. Decoding the first two parts reveals the algorithm and the claims (like user ID and expiry). This tool decodes them instantly. Note: decoding is not the same as verifying the signature.
Why use this tool
Inspect tokens safely
When debugging authentication, you often need to see what is inside a token — its claims, issued-at, and expiry. Pasting tokens into a remote decoder is risky because tokens are credentials. This tool decodes entirely in your browser, so the token never leaves your machine.
FAQ
Frequently asked questions
Header (algorithm and type), payload (claims), and signature (used to verify integrity). They are separated by dots.
No. Decoding only reads the header and payload. Verifying the signature requires the secret or public key and is a separate step.
Yes. Decoding happens entirely in your browser; the token is never uploaded, unlike many online decoders.
exp is the expiry time as a Unix timestamp. After that moment, the token should be rejected.
Advertisement
More tools