Key takeaways
- A JWT has three parts — header, payload and signature — separated by dots; the first two are readable JSON once decoded.
- JWT Decoder shows you the header and payload, and highlights the expiry (exp) claim if the token has one.
- Decoding a JWT doesn't verify its signature — it just reads the (unencrypted) content, which anyone holding the token can already see.
- Because JWTs often carry session or auth data, decoding them locally instead of on a random website matters.
Decoding a token
Paste a JWT into JWT Decoder and it splits out the header and payload as readable JSON, including converting the expiry timestamp into a normal date so you can see at a glance whether the token is still valid.
Why this is worth doing locally
A JWT's payload is base64-encoded, not encrypted — anyone who has the token can already read its contents without a secret key. That's by design. But the token itself is often a live session credential, and pasting an active auth token into a random online decoder means trusting that site with it, even briefly.
If you're decoding JWTs inside your own code rather than in a browser tab, the same logic this tool uses is also available as a small open-source package: tiny-jwt-decode on GitHub — zero dependencies, about 500 bytes gzipped.
Frequently asked questions
Can this tool verify the token's signature?
No — it decodes and displays the header and payload only. Verifying the signature requires the issuing server's secret or public key, which this tool intentionally doesn't ask for.
Is it safe to decode a production auth token here?
The decoding itself never leaves your browser, so it's safe from a network-exposure standpoint — just treat any live token carefully regardless of the tool, since its contents are already readable by design.