JWT decoder

How it works

The token is split on its two dots, and the header and payload segments are base64url-decoded (swapping back the URL-safe characters, padding with =, then running through atob()) and parsed as JSON — the signature segment is never touched cryptographically. It also reads the standard exp, iat, and nbf numeric timestamps out of the payload and converts them to readable UTC dates, flagging an exp in the past as expired.

FAQ

Does this check whether the JWT's signature is actually valid?

No — it only decodes the header and payload to show you their JSON content. Verifying a signature requires the issuer's secret or public key, which this tool never has, so a token with a forged or expired signature will still decode and display exactly like a legitimate one.

Is the data inside a JWT encrypted?

No — JWTs are base64url-encoded, not encrypted, so anyone holding the token can decode the header and payload and read every claim in plain text. A valid signature only proves the token wasn't tampered with, not that its contents are hidden from view.