How to decode a JWT
- Copy the token from wherever it lives, an
Authorization: Bearer …header in your network tab, a cookie, or alocalStoragevalue. - Paste the whole token (all three dot-separated parts) into the left JWT token box. The header and payload decode live, and the status line reports the signing algorithm and whether the token has expired.
- Press Copy decoded to drop the readable JSON into a bug report, or load Sample to see a textbook token broken apart.
What's inside a JWT?
A JSON Web Token is three Base64URL segments joined by dots, header.payload.signature. The header names the signing algorithm (for example {"alg":"HS256","typ":"JWT"}). The payload carries the claims: who the token is about, what they're allowed to do, and when it expires. The signature is a keyed hash of the first two parts that lets a server prove the token hasn't been tampered with. This decoder splits the token, Base64URL-decodes the first two segments, and pretty-prints the JSON so you can read it. The signature stays opaque because it's raw bytes, not text, and you don't need it to answer the usual debugging question, "why did my API return 401?", which the exp claim explains nine times out of ten.
Is a JWT encrypted? (No.)
This trips up almost everyone at first: the header and payload of a standard signed JWT are encoded, not encrypted. Base64URL is a reversible transform with no key, so anyone who holds the token, including this tool, and including an attacker who intercepts it, can read every claim inside it. The signature protects integrity (nobody can change the claims without invalidating it), not confidentiality. The practical rules that follow are simple: never put a password, API key, or other secret in a JWT payload; always send tokens over HTTPS; and treat a leaked token as a leaked credential. (Encrypted tokens do exist, JWE, but the everyday bearer tokens you debug are signed JWTs, which are readable.)
Frequently asked questions
Is it safe to paste a real JWT here?
Yes, decoding happens entirely in your browser, so tokens are never transmitted, logged, or sent to any server. This is safer than server-based decoders precisely because nothing leaves your machine. Still, treat production tokens like passwords and clear them from the box when you're done.
Does this verify the signature?
No. Signature verification requires the secret key or public key that only the issuing server should hold. This tool decodes the header and payload, which is exactly what you need to inspect claims, roles, and expiry, but it does not and cannot confirm the token is authentic.
Is a JWT encrypted?
No, a standard signed JWT is Base64URL-encoded, not encrypted. Anyone holding the token can read its claims, so never store secrets in the payload and always transmit tokens over HTTPS. The signature guarantees the claims weren't altered, not that they're private.
What do the exp, iat, sub, aud and iss claims mean?
exp is the expiry time and iat the issued-at time, both Unix timestamps, this tool converts exp to a readable date and flags expired tokens. sub is the subject (usually the user ID), while aud and iss identify the token's intended audience and its issuer.
Why does my token show "expired"?
The exp claim is a moment in the past relative to your device clock. An expired access token is the most common cause of a sudden 401 Unauthorized, refresh or re-issue the token. Also check that your system clock is accurate, since a badly skewed clock can make a valid token look expired.
Can I decode just one segment of the token?
Yes, each header and payload segment is plain Base64URL, so you can paste a single segment into the Base64 Decode tool to see its JSON. Pasting the whole token here is easier, though, because it also splits the parts and checks expiry for you.