JWT Decoder

A JSON Web Token is a compact, URL-safe token with three base64url parts separated by dots: a header, a payload of claims, and a signature. It is widely used to carry login and authorization data between a server and a client.

No. This tool only decodes the header and payload so you can read them. It does not check the signature, the algorithm or the key, so a decoded token must never be trusted as authentic. Use a JWT library with the signing key to verify.

The token is decoded entirely in your browser and is never sent to a server. Still, a JWT can carry sensitive data, so avoid pasting production or long-lived tokens into any online tool you do not control.

They are standard time claims in seconds since 1970 (the Unix epoch): iat is when the token was issued, exp is when it expires, and nbf is the time before which it should not be accepted. This tool shows each one as a readable UTC date.

A standard signed JWT is encoded, not encrypted. Anyone holding the token can base64url-decode the payload and read every claim, so never put secrets such as passwords in it.

Yes. Decoding only reads the base64url parts, so it works for any algorithm including HS256, RS256 and ES256. The algorithm appears in the header as the alg field.