Is my token sent to a server?

No. Decoding happens entirely in your browser with client-side JavaScript — the token you paste never leaves your device or gets logged anywhere. You can verify this by disconnecting from the network after the page loads; the tool keeps working.

Does this verify the token's signature?

No — this tool only decodes the header and payload, which are just base64url-encoded JSON and not encrypted. Verifying a signature requires the secret key or public key used to sign it, which only your backend should have.

Why can anyone read a JWT's contents?

A JWT's header and payload are encoded, not encrypted — anyone with the token can decode them, which is exactly what this tool does. Never put secrets (passwords, API keys) in a JWT payload; rely on the signature only to verify the token wasn't tampered with.

What do exp, iat, and nbf mean?

They're standard registered claims: iat (issued at), exp (expiration time), and nbf (not before) — all Unix timestamps in seconds. This tool decodes and displays them as readable dates automatically when present.

This tool runs entirely in your browser. Nothing you paste is uploaded.

How you can check →

JWT Decoder

Encoding & Decoding

Paste a JSON Web Token to see its decoded header and payload. Runs entirely in your browser — your token never leaves your device.

Decoding happens locally in your browser. Nothing you paste here is sent to any server.

JWT

Header

—

Payload

—

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It has three base64url-encoded, dot-separated parts: header.payload.signature. The header describes the token type and signing algorithm, the payload carries the actual claims (e.g. user ID, expiry), and the signature lets the issuer verify the token hasn't been tampered with.

Decoding vs. verifying

This tool decodes — it reads the header and payload so you can inspect them. It does not and cannot verify the signature, since that requires the issuer's secret or public key. Treat any claims you see here as unverified until your backend checks the signature. If the token uses HS256 and you have the secret, the HMAC generator has a JWT HS256 preset that can actually verify it, rather than just decode it.

Common use cases

Debugging why an API call is being rejected as unauthorized
Checking whether an access token has expired (see the epoch converter for raw timestamp math)
Inspecting what claims/scopes a token actually grants during development

Frequently asked questions

Is my token sent to a server?: No. Decoding happens entirely in your browser with client-side JavaScript — the token you paste never leaves your device or gets logged anywhere. You can verify this by disconnecting from the network after the page loads; the tool keeps working.
Does this verify the token's signature?: No — this tool only decodes the header and payload, which are just base64url-encoded JSON and not encrypted. Verifying a signature requires the secret key or public key used to sign it, which only your backend should have.
Why can anyone read a JWT's contents?: A JWT's header and payload are encoded, not encrypted — anyone with the token can decode them, which is exactly what this tool does. Never put secrets (passwords, API keys) in a JWT payload; rely on the signature only to verify the token wasn't tampered with.
What do exp, iat, and nbf mean?: They're standard registered claims: iat (issued at), exp (expiration time), and nbf (not before) — all Unix timestamps in seconds. This tool decodes and displays them as readable dates automatically when present.

HMAC Generator

HMAC-sign or verify a message, with real key-encoding support and the actual Stripe, GitHub, Slack and Shopify signing schemes — not just HMAC(secret, body).

Base64 Encoder/Decoder

Encode text to base64 or decode base64 back to text.

JSON Formatter & Validator

Format, minify and validate JSON without your numbers changing.