What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format commonly used for authentication and authorization. It has three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims, such as the subject and expiration), and a signature.
How to use this tool
Paste a JWT to see its decoded header and payload as readable JSON, along with any iat, nbf, and exp claims converted to human-readable dates. This tool only decodes — it never checks the signature, since that would require the issuer's secret or public key.
FAQ
Does this verify the token is valid/trusted?
No. Decoding only reveals the claims a token carries — it does not prove the token wasn't tampered with. Signature verification requires the issuer's secret key and should happen on your server, not in a public browser tool.
Is my token sent anywhere?
No. Decoding happens entirely in your browser. That said, treat real tokens as sensitive — avoid pasting production tokens into any tool you don't fully trust.