JWT Decoder
Paste a JWT, access token, or bearer token to see its decoded header and payload. This decodes only — it does not verify the signature.
Not sure what a claim means? Read: How to Decode a JWT Token
Building or verifying JWTs server-side? Read: JWT Algorithm Confusion Attacks
How it works
This tool splits a JWT into its header, payload, and signature segments and decodes the Base64URL-encoded header and payload back to readable JSON — entirely client-side, since a JWT's header and payload were never encrypted, only encoded.
When you’d use this
- Checking what claims an auth token actually carries during debugging
- Confirming a token's expiration (exp) or issued-at (iat) timestamp
- Inspecting a token issued by a third-party API or auth provider
Common questions
Is a bearer token or access token the same as a JWT?+
Often, yes — "bearer token" describes how a token is used (sent in an Authorization: Bearer <token> header, and accepted from whoever holds it), and "access token" describes its role in OAuth2/OIDC flows. Neither name says anything about the token's format. Many APIs and identity providers (Auth0, Firebase, AWS Cognito, Okta) issue access/bearer tokens that are themselves JWTs — if yours has three dot-separated parts, paste it in above and this tool will decode it the same way.
Is it safe to paste my JWT here?+
Yes — decoding happens entirely in your browser. The token never leaves your device or gets sent to any server, which matters since a JWT's payload often contains user information.
Why can't this tool verify if my token is valid?+
Verifying a signature requires the secret key or public key used to sign the token — something only your backend has. This tool decodes the readable header and payload, which anyone can do without a key, but signature verification is intentionally a server-side operation for security.
What does the 'exp' field mean?+
It's the expiration timestamp, in Unix time (seconds since Jan 1, 1970). Once the current time passes this value, a properly-implemented backend will reject the token as expired. Pair it with our Timestamp Converter to see it as an actual date.
My token only has two parts, not three — is that normal?+
A standard signed JWT always has three parts (header.payload.signature). If yours only has two, it may be an unsigned/unsecured JWT (alg: "none"), or it could be truncated — check that you copied the entire token.
Can I edit a JWT and re-sign it here?+
No, and that's intentional — this is a read-only decoder for debugging and inspection. Editing and re-signing tokens requires the original signing key, which this tool never has access to (by design, for security).