🔑 JWT Decoder
Paste a JWT (JSON Web Token) to decode its header and payload — everything happens locally in your browser.
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and authorization. It consists of three Base64URL-encoded parts separated by dots: a header, a payload, and a signature.
Does this tool verify the JWT signature?
No. This tool only decodes the header and payload to readable JSON — it does not verify the signature, since that requires the server's secret key or public key. It's meant for inspecting token contents, not validating authenticity.
What do "exp" and "iat" mean?
"iat" (issued at) is the Unix timestamp when the token was created. "exp" (expiration) is the Unix timestamp after which the token is no longer valid. This tool converts both to readable dates and shows whether the token has expired.
Is my token sent to a server?
No. Decoding happens entirely in your browser using JavaScript's built-in Base64 decoding — your token never leaves your device.
Why does it say "Invalid JWT"?
A valid JWT must have exactly three dot-separated parts, where the first two parts are valid Base64URL-encoded JSON. If the format doesn't match, the tool can't decode it.
What's the difference between Base64 and Base64URL?
Standard Base64 uses '+', '/' and '=' padding, which aren't safe in URLs. Base64URL replaces '+' with '-', '/' with '_', and omits padding — that's the encoding JWTs use for their header and payload segments.
What is the "alg" field in the header?
"alg" specifies the signing algorithm used to create the signature, such as HS256 (HMAC with SHA-256) or RS256 (RSA with SHA-256). The header may also include "typ" (token type, usually "JWT") and "kid" (key ID).
Can I edit a JWT and re-sign it with this tool?
No — this tool is read-only and only decodes existing tokens for inspection. Editing and re-signing a JWT requires the issuer's secret or private key, which should never be entered into a browser-based tool.