JWT (JSON Web Token) is a compact, URL-safe token format used for authentication. It contains three dot-separated parts: a header, a payload, and a signature.

How do I decode a JWT token?

Paste the JWT string into the input field. The tool instantly splits and decodes the header and payload sections and displays timestamps in readable form.

Is it safe to decode a JWT token online?

Yes. Your token is decoded locally using JavaScript — it never leaves your browser or gets sent to any server.

Can I verify a JWT signature here?

This tool decodes header and payload for inspection. Full signature verification requires your secret key — never paste your secret into any online tool.

What is the difference between JWT decode and decrypt?

Standard JWTs are signed but not encrypted — the payload is Base64Url-encoded and readable without a key. JWE tokens are encrypted and require a key to read.

Tools / JWT Decoder

JWT Decoder & Encoder

Decode JWT headers and payloads, inspect time claims, and generate HMAC-signed tokens in your browser.

Encoded JWT Token

Header: Algorithm & Token Type

Payload: Data

Token Status

WAITING

Issued At (iat): -

Not Before (nbf): -

Expires At (exp): -

Signature

Inspect JSON Web Tokens Safely

Decode Claims

Paste a JWT to decode the Base64Url header and payload into readable JSON.

Check Time Claims

Convert `iat`, `nbf`, and `exp` UNIX timestamps into local time and quickly identify expired tokens.

Generate HMAC Tokens

Create HS256, HS384, or HS512 signed tokens locally with the browser Web Crypto API.

JWT Security Notes

A standard JWT is signed, not encrypted. Header and payload data are Base64Url encoded and can be decoded by anyone with the token, so avoid placing passwords, secrets, or sensitive personal data inside claims.

Private Browser-Based Processing

Decoding, formatting, and HMAC signing happen in your browser. The token, payload, and signing secret are not sent to a backend by this page.

Frequently Asked Questions

What is a JWT token?: JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and authorization. It contains three dot-separated parts: a header, a payload, and a signature.
How do I decode a JWT token?: Paste the JWT string (the full eyJ... value) into the input field. The tool instantly splits and decodes the header and payload sections, and displays expiry and issued-at timestamps in readable form.
Is it safe to decode a JWT token online?: Yes, when using a browser-based tool like this one. Your token is decoded locally using JavaScript — it never leaves your browser or gets sent to any server.
Can I verify a JWT signature here?: This tool decodes the header and payload for inspection. Full signature verification requires your secret key — which you should never paste into any online tool. Verify signatures in your own codebase.
What is the difference between JWT decode and decrypt?: Standard JWTs (JWS) are signed, not encrypted — the payload is only Base64Url-encoded so it can be decoded without a key. JWE (JSON Web Encryption) tokens are actually encrypted and require a key to read.

Also Try