Loading page
Decode JWT header and payload.
A JWT (JSON Web Token) is a compact, URL-safe token made of three base64url-encoded parts separated by dots: a header, a payload of claims, and a signature. This tool splits the token and decodes the header and payload into readable JSON.
It is handy for inspecting what an authentication token contains — the algorithm, the subject, and timing claims like when it was issued and when it expires.
No. It only decodes the header and payload for inspection. Verifying authenticity requires the signing secret or public key and must be done server-side — never trust an unverified token for authorization.
No. The payload is merely base64url-encoded, so it is fully readable by anyone who holds the token. The signature protects integrity, not confidentiality.
If the payload's exp claim (a Unix timestamp) is earlier than the current time, the token is past its expiry. The tool converts exp/iat/nbf to readable dates so you can check.