JWT Decoder
Paste a JWT to see its decoded header and payload, the signing algorithm, and human-readable issued-at and expiry times. The signature is not verified — this is for inspection, not authentication.
Paste a JWT
Algorithm
HS256
Issued at
11/15/2023, 3:43:20 AM
Expires
11/15/2023, 4:43:20 AM
still valid
Signature
present
not verified
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Asha R",
"iat": 1700000000,
"exp": 1700003600
}Decodes the header and payload only — it does not verify the signature, so it cannot tell you whether the token is authentic. A JWT payload is just base64, not encryption: never put a secret in one. Everything is decoded in your browser and never uploaded.
FAQ
- Does this verify the signature?
- No. It only base64-decodes the header and payload. It cannot tell you whether the token is authentic or was tampered with — do that server-side with the secret or public key.
- Is it safe to paste a token here?
- The decoding happens entirely in your browser and nothing is sent anywhere. Still, treat any live token as a credential and avoid pasting production tokens into any online tool.
Related tools
- JSON Formatter & ValidatorPretty-print, minify and validate JSON in the browser.
- Number Base ConverterConvert an integer between binary, octal, decimal and hex.
- URL Encode / DecodePercent-encode a query value or a whole URL, and decode it back.
- Text Compare (Diff)Spot every added and removed line between two blocks of text.
- Base64 Encode / DecodeText ⇄ Base64, Unicode-safe.
Free to use, no sign-up. Calculations run in your browser — nothing you type is sent to a server. These tools are for general information only, not professional advice. See the full tool list.