JWT Decoder
Decode JSON Web Tokens in your browser — inspect header, payload, and signature without a server round-trip.
JWT Decoder
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1705224000,
"exp": 1999999999
}Об инструменте
A JSON Web Token (JWT) is a compact, URL-safe way to send signed claims between two parties. It shows up everywhere in modern web auth — as a Authorization: Bearer <token> header on every API call, in OAuth flows, in magic links, and in service-to-service trust. When something goes wrong with auth, the first thing you do is read the token.
A JWT has three base64url-encoded parts separated by dots: header.payload.signature. The header describes the algorithm; the payload holds the claims (the actual data); the signature proves the token was issued by the holder of the signing key. Decoding the first two is trivial — they're plain base64url; verification of the third needs the key and algorithm.
This tool decodes the header and payload instantly in your browser. The signature is shown as-is (we do not verify it — that requires the signing key and a deliberate cryptographic check). The output is a pretty-printed JSON for each part, plus useful metadata: whether the token is expired, when it was issued, and the algorithm.
Everything runs locally — paste the token, see the claims. The token never leaves your browser, so it's safe to inspect tokens from production logs, support tickets, or anywhere else. `
This tool is a decoder only; it does not (and cannot) verify signatures without the signing key. For that, look up the appropriate library for your stack.