Paste a JSON Web Token to read its header and payload, with issued/expiry times decoded.
🔒 Your token is decoded entirely in your browser and never sent anywhere — safe for real tokens, unlike most online decoders. This tool decodes a JWT; it does not verify the signature (that requires your secret or public key).
A JSON Web Token has three base64url-encoded parts separated by dots: a header (the signing algorithm), a payload (the claims — who the token is for, when it was issued, when it expires), and a signature. The header and payload are only encoded, not encrypted, so anyone can read them — which is exactly what this tool shows.
Decoding reveals the claims; verifying proves the token wasn't tampered with and needs the secret (HMAC) or public key (RSA/EC). This tool decodes locally so you can inspect a token safely; it never transmits it. To explore a large or deeply-nested payload, send it to the full JSON viewer.