What is a JWT, and what does decoding show?
A JSON Web Token is three base64url parts joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries the claims such as sub, exp and iat, and the signature proves the first two parts were not altered. Decoding simply base64url-decodes the first two parts — anyone can do it, and it never requires a key.
A token that begins eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 decodes to the header {"alg":"HS256","typ":"JWT"}. Its payload, for example {"sub":"42","exp":1735689600}, shows user 42 with an expiry of 1 Jan 2025. The third part is the signature: displayed here, but not verified. Without the HMAC secret or the RSA/ECDSA public key this browser-only tool cannot prove the signature is genuine, so never treat a decoded token as trustworthy.
How to decode a JWT
- Paste the complete token into the JWT field.
- Read the decoded Header and Payload as JSON.
- Check exp and iat, which are shown as human-readable dates and flagged when the token has expired.
- Copy any part, or clear the field to try another token.
Frequently asked questions about JWT decoding
Does the tool verify the signature?
No. It only decodes and displays the header, payload and signature. Verification needs the secret or public key, which this browser-only decoder deliberately never receives.
Is it safe to paste a token here?
Decoding happens entirely in your browser and nothing is uploaded. Even so, avoid pasting production tokens into any online tool — a real token is a live credential.
What do exp and iat mean?
Both are Unix timestamps in seconds: iat is when the token was issued, exp is when it expires. The tool converts them to dates and marks an expired token.
