JWT Decoder
Runs in your browserPaste a JWT to see its header, payload and claims. Decoding happens as you type, in this tab.
Header
Payload
How this one works
A JWT is three Base64URL strings joined by dots: a header saying how it was signed, a payload of claims, and a signature. The first two are just encoded JSON — anyone holding the token can read them, which is exactly what this page does, without a network request.
Times such as exp and iat are seconds since 1970; they’re shown in your local time zone and the expiry badge counts down live. A leading Bearer or surrounding quotes are stripped automatically.
Questions
- Is it safe to paste a real token here?
- Nothing you paste leaves the tab: decoding is plain JavaScript and there is no server to send it to. Still, a live token pasted anywhere is worth treating as exposed — rotate it if it grants real access.
- Does decoding prove the token is genuine?
- No. The header and payload are only encoded, not encrypted, so anyone can write a token that decodes cleanly. Only a valid signature shows the claims came from whoever holds the key — use the JWT Verifier for that.
- Why does it say my token has five parts?
- Five dot-separated parts means a JWE — an encrypted token. Its payload can only be read with the decryption key, so it can’t be decoded here.