A JSON Web Token is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. APIs use JWTs as bearer tokens. This tool only decodes the parts so you can read them.

Does this decoder verify the signature?

No. Verification needs the secret or public key and must happen on a trusted server. Decoding only shows what the token claims, which anyone can forge.

Is my token sent to a server?

No. Decoding runs entirely in your browser. Nothing you paste is uploaded, logged, or stored.

Why do I see an error?

A valid JWT has exactly three parts. The header and payload must be Base64URL-encoded JSON. Extra dots, missing parts, or corrupted encoding produce a friendly error.

Can I trust exp, sub, or role claims from this tool?

Not by themselves. Anyone can create a token with any claims. Use this view to debug tokens you already have, then verify signatures in your backend.

Base64URL is Base64 with + and / replaced by - and _, and padding often omitted. JWT header and payload use this encoding so tokens are URL-safe.

How do I convert JWT exp/iat Unix timestamps into a date?

In a JWT payload, `iat` is the “issued at” Unix time and `exp` is the “expires at” Unix time. Copy those numbers and paste them into the Unix Timestamp Converter: https://www.toolsminify.com/converter-tools/timestamp-converter. That tool converts the Unix seconds or milliseconds into a readable UTC and local date/time.

Developer Tools

JWT Decoder

Paste a JSON Web Token to inspect its header, payload, and signature.

JSON Web Token

Decode only - this tool does not verify the signature. Do not trust claims until a server verifies the token.

About JWT Decoder

Paste a JSON Web Token to inspect its header, payload, and signature. This free JWT decoder splits the token on dots, Base64URL-decodes the first two parts, and pretty-prints the JSON. It does not verify the signature - treat decoded claims as untrusted until a server checks them. Everything runs client-side; the token never leaves your browser.

How to Use JWT Decoder

Paste a JWT into the input. A Bearer prefix is optional and is stripped automatically.
The header and payload appear as pretty-printed JSON. The signature is the raw third segment.
Copy any section with one click.
If the token is malformed, a short error explains whether the structure, encoding, or JSON is wrong.

JWT Decoder Examples

Standard three-part JWT

header.payload.signature decodes to a JSON header (alg, typ), a JSON payload (claims such as sub, iat, exp), and a Base64URL signature.

Authorization header

Paste Bearer eyJ... - the tool strips the Bearer prefix and decodes the token.

Unsecured JWT (alg none)

A token with an empty third segment still decodes. The signature field is blank - this tool still does not verify anything.

Read the full guide

How to Use JWT Decoder: Complete Guide (2026) - 5 min read

Frequently Asked Questions about JWT Decoder

What is a JWT?: A JSON Web Token is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. APIs use JWTs as bearer tokens. This tool only decodes the parts so you can read them.
Does this decoder verify the signature?: No. Verification needs the secret or public key and must happen on a trusted server. Decoding only shows what the token claims, which anyone can forge.
Is my token sent to a server?: No. Decoding runs entirely in your browser. Nothing you paste is uploaded, logged, or stored.
Why do I see an error?: A valid JWT has exactly three parts. The header and payload must be Base64URL-encoded JSON. Extra dots, missing parts, or corrupted encoding produce a friendly error.
Can I trust exp, sub, or role claims from this tool?: Not by themselves. Anyone can create a token with any claims. Use this view to debug tokens you already have, then verify signatures in your backend.
What is Base64URL?: Base64URL is Base64 with + and / replaced by - and _, and padding often omitted. JWT header and payload use this encoding so tokens are URL-safe.
How do I convert JWT exp/iat Unix timestamps into a date?: In a JWT payload, `iat` is the “issued at” Unix time and `exp` is the “expires at” Unix time. Copy those numbers and paste them into the Unix Timestamp Converter: https://www.toolsminify.com/converter-tools/timestamp-converter. That tool converts the Unix seconds or milliseconds into a readable UTC and local date/time.

Hash Generator

Generate SHA-256, SHA-1, SHA-384, and SHA-512 hashes from any text. Get the lowercase hex digest instantly in your browser - nothing is uploaded.

Base64 Encoder / Decoder

Free online Base64 encoder and decoder. Encode text to Base64 or decode Base64 back to plain text, with full Unicode (UTF-8) support - runs entirely in your browser.

URL Encoder / Decoder

Encode text and URLs to percent-encoding or decode encoded URLs back to plain text. Switch between encodeURIComponent and encodeURI, right in your browser.