Dailiyo

JWT Decoder

Decode and inspect JSON Web Tokens (JWT) — see the header and payload safely in your browser without sending the token anywhere.

JWT Decoder

JWT Decoder — inputs

Enter your values above and press Convert to see the result.

This tool runs entirely in your browser — no data is sent to our servers. If JavaScript is disabled, the fully interactive version will not run; enable JavaScript to compute results.

About this jwt decoder

A JWT is three Base64url-encoded segments separated by dots: header, payload and signature. The header describes the algorithm used to sign the token. The payload contains the claims (who the user is, when the token expires, what they can access). The signature proves the token was issued by a trusted party and has not been modified.

The decoder reveals what is in the header and payload but does NOT verify the signature — verification needs the secret key (for HS256) or the public key (for RS256, ES256). Decoded but unverified payload should never be trusted for authorization decisions in production; this tool is for debugging only.

JWTs are a common authentication token in modern web apps. Knowing how to inspect one is essential for debugging auth flows, checking expiry, and confirming what claims your service is receiving.

How to use it

  1. Paste the JWT (three dot-separated Base64url segments) into the input box.
  2. Read the decoded header, payload and signature.
  3. Check the expiry (exp claim) and issued-at time (iat claim) if present.

Tips & notes

  • NEVER paste a production token containing real secrets into untrusted web tools. This tool runs in your browser, but as a habit, generate test tokens for inspection.
  • The "exp" claim is a Unix timestamp — convert it with the Age Calculator or a Unix timestamp tool if you need a readable date.
  • The signature segment alone does not tell you whether the token is valid; verification requires the signing key on the server side.

Frequently asked questions

Does the decoder verify the signature?

No. Verification requires the secret (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms). The decoder shows the signature but does not validate it.

Is the token I paste sent to a server?

No. Decoding runs entirely in your browser using JavaScript atob() function. The token stays on your device.

What is the difference between JWT and JWS / JWE?

JWT is the data structure. JWS (JSON Web Signature) is the format for signed tokens — the common case. JWE (JSON Web Encryption) is the format for encrypted tokens, where the payload is hidden from anyone without the key.

JWT Decoder in the Developer collection

The JWT Decoder lives alongside Base64 Converter, HTML Code Compiler, JSON Formatter & Validator on the Developer page. That landing page collects every developer tool Dailiyo publishes, plus the editorial notes on formula sources, review cadence and how each result should (and should not) be interpreted. If a related developer calculation isn't yet in the collection and you'd like to see it, drop a line via the contact page — the editorial team reviews every request and prioritises tools that come up most often in reader questions.

Last reviewed: by the Dailiyo editorial team, part of Xposure Soft Solution. Read our content review policy for details on how often we re-verify calculators.