Is my token uploaded?

No. Decoding is purely local — the token never leaves your browser. This is safe even for real production tokens.

Why does the signature part decode to garbage?

The signature is raw binary, not JSON. This tool shows the decoded header and payload only; it does not verify the signature.

What are the common claims?

iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at), jti (JWT id). Numeric dates are Unix seconds.

Why are exp and iat numbers instead of dates?

The JWT specification defines these claims as NumericDate values — seconds since 1970-01-01T00:00:00Z. This tool converts them to readable dates and also tells you whether exp is in the past.

Usually not. A signed JWT (JWS) only encodes the header and payload as base64url, so anyone holding the token can read them — the signature protects integrity, not secrecy. Never put secrets in the payload. Encrypted tokens use the separate JWE format.

How do I verify the signature?

Verify it on your server with a trusted JWT library and the correct key: the shared secret for HS256 or the public key for RS256/ES256. Also check the algorithm, expiry, issuer and audience. Never trust client-side decoding for authorization.

JWT Decoder

Decode JWT header and payload without sending the token anywhere.

Frequently asked questions

Is my token uploaded?: No. Decoding is purely local — the token never leaves your browser. This is safe even for real production tokens.
Why does the signature part decode to garbage?: The signature is raw binary, not JSON. This tool shows the decoded header and payload only; it does not verify the signature.
What are the common claims?: iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at), jti (JWT id). Numeric dates are Unix seconds.
Why are exp and iat numbers instead of dates?: The JWT specification defines these claims as NumericDate values — seconds since 1970-01-01T00:00:00Z. This tool converts them to readable dates and also tells you whether exp is in the past.
Is a JWT encrypted?: Usually not. A signed JWT (JWS) only encodes the header and payload as base64url, so anyone holding the token can read them — the signature protects integrity, not secrecy. Never put secrets in the payload. Encrypted tokens use the separate JWE format.
How do I verify the signature?: Verify it on your server with a trusted JWT library and the correct key: the shared secret for HS256 or the public key for RS256/ES256. Also check the algorithm, expiry, issuer and audience. Never trust client-side decoding for authorization.

About this tool

A JSON Web Token is three base64url parts separated by dots: a header describing the algorithm, a payload of claims, and a signature. This decoder shows the header and payload as readable JSON and converts exp/iat timestamps into dates. Decoding happens entirely in your browser, so even production tokens are safe to inspect.

How to use it

Paste the full JWT (header.payload.signature) into the token field.
Read the decoded payload in the code panel and the algorithm/expiry cards.
Check the expiry card to see whether the token is still valid.
Remember that decoding is not verification — signatures must be checked on your server.

← All tools