JWT Decode

Paste a token, read what's inside before you trust it.

A JWT is three Base64URL segments joined by dots — a header, a payload, and a signature. This tool splits them apart, decodes the header and payload back into readable JSON, and can check a signature against a secret you provide. Decoding is not the same as verifying — read on for the difference.

01 · Input

segment map 0 characters

Header

Payload

Signature

02 · Process

Split the token on each "." into header, payload, and signature.

Decode the header and payload from Base64URL back into UTF-8 text, then parse as JSON.

Read standard claims like exp and iat as human dates automatically.

Optionally verify an HS256/384/512 signature locally, using the Web Crypto API.

Verify signature optional

Verification happens locally using your browser's crypto engine. Only symmetric algorithms (HMAC) are supported here, since RS/ES/PS algorithms need the issuer's public key, not a value you'd paste into a tool.

03 · Output

Paste a token above to see it decoded here.

Tip: the Example button above loads a sample HS256 token with common claims — use secret your-256-bit-secret to see verification succeed.

How it works

Three segments, one dot-separated string

Header

A small JSON object naming the signing algorithm (alg) and token type (typ), Base64URL-encoded.

Payload

The claims — arbitrary data plus registered fields like sub, iat, and exp. Anyone can read this; it isn't encrypted.

Signature

Proves the header and payload weren't altered after signing — if you hold the right key or secret.

Decode vs. verify

Decoding just reads the Base64URL — anyone can do it. Verifying checks the signature, and needs a secret or public key.

FAQ

Common questions

Does my token get sent to a server?+

No. Every step — splitting, decoding, and optional signature verification — runs in JavaScript in your browser. Nothing is transmitted, logged, or stored.

Why can I read the payload without a secret?+

A JWT's payload is only Base64URL-encoded, not encrypted. Treat it like a sealed envelope with a clear window: tamper-evident, but not private. Never put secrets inside a JWT payload.

Why did verification fail even though the token looks fine?+

The most common causes are a mismatched secret, whitespace accidentally copied into the token or secret field, or a token signed with an asymmetric algorithm (RS/ES/PS), which this tool can't verify without a public key.

What does an expired token mean?+

The exp claim is a Unix timestamp for when a token stops being valid. This tool flags it for you, but enforcing expiry is the server's job — decoding alone won't reject an expired token.

Can I decode tokens that use RS256 or ES256?+

Yes — the header and payload decode the same way regardless of algorithm. Only signature verification is limited to HMAC algorithms here, since asymmetric algorithms need a public key rather than a shared secret.

Related tools

Paste a token, read what's inside before you trust it.

Three segments, one dot-separated string

Header

Payload

Signature

Decode vs. verify

Common questions

From the same toolkit

Base64 Encode / Decode

JSON Formatter

Timestamp Converter

UUID Generator