What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to transmit claims between parties — most often used for authentication (OAuth2 access tokens, login sessions). It consists of three base64url-encoded parts separated by dots: header.payload.signature. The header describes the signing algorithm; the payload carries claims like sub, exp, iat; the signature proves the token hasn't been tampered with.
How to Decode a JWT
Decoding is just base64url-decoding the first two parts — no secret key needed. Paste a token into this decoder and you'll instantly see the header and payload as formatted JSON, plus human-readable dates for exp (expiry), iat (issued at), nbf (not before), and a validity badge. Any algorithm or signature — all clients can decode the claims.
Why Can I Decode Without the Secret?
JWTs are not encrypted — they're signed. Anyone can read the header and payload; the signature is what prevents forgery. That's why you should never put sensitive data in a JWT payload. Verification (checking the signature) requires the secret or public key; decoding the contents does not.
JWT Decoder FAQ
Is decoding the same as verifying? No — decoding shows the contents; verifying checks the signature with a key. Can this tool forge a token? No — it only decodes and never touches keys. Is my token sent anywhere? No — everything is decoded locally in your browser. Why does my JWT have more than 3 parts? Some tokens (like JWE) are encrypted with more segments — this decoder handles standard 3-part JWTs.