JWT Decoder

Reading a JSON Web Token

A JWT is three Base64url strings joined by dots: header.payload.signature. The header says which signing algorithm was used, the payload carries claims such as the user id and expiry, and the signature proves the token was not tampered with. A decoder splits the token and Base64url-decodes the first two parts so you can read them.

Decoding is not verifying

This is the single most important thing to understand. The header and payload are only encoded, never encrypted. Anyone who holds the token can read every claim in it. Decoding tells you what the token claims; it does not tell you whether the claims are trustworthy. Trust comes only from checking the signature against the issuer secret or public key, which a client-side decoder cannot and should not do with your server key.

Example

A decoded payload typically looks like:

{
  "sub": "1234567890",
  "name": "Ada",
  "iat": 1700000000,
  "exp": 1700003600
}

Here iat is issued-at and exp is expiry, both Unix timestamps. To turn those into a readable date, use the timestamp converter.

FAQ

Can I see the password or secret inside? No. The secret never travels in the token. The signature is derived from it but cannot be reversed back into the key.

Why is my token rejected even though it decodes fine? Decoding only reads the data. The server may reject it because the signature does not match, the exp time has passed, or the alg is not one the server accepts.

Is it safe to paste a token into a decoder? Treat a live token like a password. If it still grants access, pasting it anywhere it could be logged is a real risk. Prefer decoding expired or test tokens.