JWT Decoder
A JWT Decoder parses a JSON Web Token into its three Base64URL-encoded segments — header, payload, and signature — and renders the header and payload as readable JSON, all inside your browser so the token never leaves your device.
About JWT Decoder
Paste a JWT to see its decoded header (algorithm, type) and payload (claims like sub, iat, exp, scope). The decoder also surfaces human-readable timestamps for iat, nbf, and exp so you can spot expired tokens at a glance. Decoding is informational only — it does not verify the signature, since verification requires the secret or public key.
What JWT Decoder does
- Splits a JWT into header, payload, and signature in one paste
- Renders header and payload as syntax-highlighted JSON
- Surfaces iat, nbf, and exp as human-readable timestamps with expired indicator
- Detects algorithm (HS256, RS256, ES256, none) from the header
- Token is never transmitted — decoded entirely in your browser
When to reach for JWT Decoder
- Debugging why an API rejects a token with a generic 401
- Spotting an expired exp claim at a glance
- Inspecting the scope or roles claim while wiring up authorization
- Sanity-checking a token your auth provider just minted in staging
How to use JWT Decoder
- 01
Paste your JWT
Paste the three-segment token into the input area.
- 02
Read the claims
Header and payload appear immediately as formatted JSON. Expiration is highlighted if exp is past.
- 03
Compare
Toggle the raw-Base64 view to compare segments side by side with the decoded JSON.
When to use JWT Decoder vs alternatives
| Alternative | Use JWT Decoder when… | Use the alternative when… |
|---|---|---|
| jwt.io online debugger | the token belongs to a production user and cannot be pasted into a third-party service. | you also want to verify the signature with a public key you have. |
| Decoding manually in the browser console | you want timestamps and expiration formatted for you. | you are already in DevTools and want zero context switch. |
Frequently asked questions
Does this verify the JWT signature?
Is it safe to paste a real JWT here?
Why does my JWT show as 'expired'?
Can I decode a JWE (encrypted JWT)?
Related tools
Related reading
Privacy · 12 min read
Which AI coding tools train on your code? A 2026 privacy guide
Whether an AI coding assistant trains on your code or keeps it private usually comes down to one thing: your subscription tier, not the tool. Here's a current, tier-by-tier breakdown of what GitHub Copilot, Cursor, Claude Code, ChatGPT and Gemini actually do with the code you send them — how to lock each one down, and when the only real guarantee is a local model.
Security · 10 min read
Vibe coding safely: shipping an AI-built app without leaking secrets or bugs
Vibe coding — describing what you want and letting an AI write most of the code — is a genuinely fast way to build. It is also a fast way to leak API keys, install a hallucinated package, and ship an app you do not understand well enough to secure. Here is a practical threat model and a safe workflow that keeps the speed without the accidents.