JSON Web Token (JWT) Decoder
Decode and inspect your JWT token claims. All translations happen inside your browser, so your security tokens are never shared.
{ }{ }How JSON Web Tokens Work
Three Dot-Separated Strings
A JWT consists of three parts separated by dots (`.`): the Header, the Payload, and the Signature. - The **Header** typically consists of the token type (JWT) and the signing algorithm (e.g. HMAC SHA256 or RSA). - The **Payload** contains the claims—statements about an entity (typically, the user) and additional metadata (expiration time `exp`, issue time `iat`). - The **Signature** is computed using the secret/public key to verify that the sender is who it claims to be.
Decoding vs. Verification
It is crucial to understand that decoding a JWT does **not** prove its authenticity. Base64URL encoding is merely a format translation—anyone can decode a token. Authentication requires verifying the signature using the private/public cryptographic key.
How to Use JWT Decoder & Inspector
Paste JWT Token String
Paste your encoded JSON Web Token (eyJhbGciOi...) into the input box.
Instant Base64Url Decode
The tool splits the token into three parts: Header, Payload claims, and Signature.
Inspect Claims & Expiration
Verify token issuance (iat), expiration (exp), subject (sub), issuer (iss), and custom claims.
Copy Payload JSON
Copy decoded claims safely without exposing bearer tokens to external servers.
Key Features & Capabilities
- Side-by-side Header, Payload & Signature decode
- Human-readable expiration & issuance timestamp formatting
- Algorithm identification (HS256, RS256, ES256)
- Copy payload JSON to clipboard
- 100% private offline browser execution
100% Client-Side Privacy: All operations occur locally in your web browser memory using JavaScript and WebAssembly. Your files, text payloads, and images are never uploaded to external servers or stored in cloud databases.
Frequently Asked Questions
View All Platform FAQsIs my JWT token transmitted over the network?
No. Decoding occurs entirely in your browser's JavaScript memory. Tokens and auth credentials are never sent to remote servers.
Does this tool verify JWT signature secret keys?
Signature decoding confirms signature algorithm type (e.g. HS256, RS256). Since client-side secret verification would expose private keys, key signatures should be verified on your auth server.
Experiencing an issue with JWT Decoder & Inspector?
Notice a bug, calculation error, or unexpected result? Let us know.