JWT Decoder

What is a JWT?

A JWT (JSON Web Token) is a compact, URL-safe token that carries claims between two parties, used in authentication and authorization flows such as login sessions and API access. It consists of three base64url-encoded parts separated by dots.

What is inside a JWT?

• Header: the token type and signing algorithm, e.g. alg: HS256.
• Payload: the claims, e.g. sub, exp and other custom data.
• Signature: verifies the token was not tampered with.

Is my data safe?

Yes. Decoding happens entirely in your browser; the token is never sent to any server. Note that decoding does not verify the signature — a JWT is readable by everyone who receives it.

What a decoded token shows

• Header: the signing algorithm, like HS256 or RS256.
• Payload: claims such as issuer, subject, scope and expiry, translated from base64url.
• Signature: the cryptographic digest — shown but never decrypted, because it cannot be.
• Timestamps appear in readable form, not raw epoch numbers.

Store nothing sensitive here

Decoding is purely local — the tool never sends your token anywhere and never needs your secret. But a decoded JWT reveals its payload in plain text: if a token contains personal data, treat the decoded view as sensitive output, not as a storage area.