JWT Decoder

A JWT (JSON Web Token) is three base64url-encoded pieces joined by dots: a header (which algorithm signed it), a payload (the actual claims — who it's for, when it expires, and whatever custom data an API attaches), and a signature (proof the first two pieces haven't been tampered with, if you have the secret or public key to check it).

Decoding a JWT just means reversing the base64url encoding on the header and payload to read the JSON underneath — no cryptography required, no secret needed. That's the part this tool does. Verifying, on the other hand, means recomputing the signature with a known secret or public key and confirming it matches — a completely different operation that this tool deliberately doesn't attempt, so it never gives a false sense of trust.

• •Never treat a decoded JWT's claims as trustworthy on their own — anyone can decode a token, and anyone with a text editor can also forge one that decodes into whatever claims they want. Only a passed signature verification makes claims trustworthy.
• •Watch the exp (expiry) claim when debugging "why am I logged out" issues — an expired token will decode perfectly fine; decoding success has nothing to do with whether the token is still valid.
• •If a token has no exp claim at all, it never expires by JWT's own rules — that's often a deliberate design choice (e.g. long-lived API keys), but confirm it's intentional before shipping.
• •Don't paste a production token with real user data into any tool you don't control — decoding happens entirely in your browser here, but as a habit, treat JWTs the same way you'd treat a password when deciding where to paste them.