JWT Decoder

JWT Decoder

A JSON Web Token (JWT, RFC 7519) is three Base64URL-encoded segments joined by dots: header.payload.signature. The header is a small JSON object naming the signing algorithm ("alg", e.g. "HS256" or "RS256") and token type ("typ": "JWT"). The payload is a JSON object of "claims" — arbitrary data the issuer wants to carry, plus a handful of registered claim names with conventional meaning: "sub" (subject, usually a user ID), "iss" (issuer), "aud" (audience), "exp" (expiration, a Unix timestamp after which the token should be rejected), "iat" (issued-at) and "nbf" (not valid before). The signature is a cryptographic MAC or digital signature over the header and payload, computed with a secret or private key only the issuer holds.

Decoding is not the same thing as verifying. Decoding — what this tool does — just reverses the Base64URL encoding and parses the resulting bytes as JSON; it requires no key and proves nothing about authenticity. Verifying checks the signature against the issuer's actual secret or public key, which is the only way to know a token wasn't tampered with or forged. Because a JWT's header and payload are only encoded, not encrypted, ANYONE who has the token text — including this tool, a browser extension, or a malicious site you paste it into — can read every claim inside it in plain text. This is precisely why the notice above this tool exists: a JWT is not a secret container, and decoding one here proves nothing about whether you should trust it.

Developers reach for a decoder like this most often while debugging: checking whether an "exp" claim has actually passed (a very common source of confusing 401 errors), confirming which "aud"/"iss" values an OAuth or OpenID Connect provider is issuing, or simply inspecting what claims a third-party API's token carries before writing code against it. None of that requires touching the signature at all — the structure alone answers most of these questions.

The header and payload segments use Base64URL, not standard Base64 (RFC 4648 §5: "-"/"_" instead of "+"/"/", and no padding) — a detail this tool handles for you automatically. If a segment fails to decode, it's usually because the pasted text is missing a segment (a valid JWT always has exactly three dot-separated parts), was truncated when copied, or simply isn't a JWT at all.

Glossary

JWT

JSON Web Token (RFC 7519) — a compact, URL-safe token format encoding a JSON payload of claims, signed to prove it wasn't tampered with.

Claim

A single piece of data in a JWT's payload — either a registered name with conventional meaning (sub, exp, iat) or a custom, application-defined field.

exp / iat

Registered claims holding Unix timestamps: "exp" is when the token expires and should be rejected; "iat" is when it was issued.

Signature

A cryptographic MAC or digital signature over the header and payload, computed with a key only the issuer holds — the part this tool deliberately never checks.

alg

The header field naming the signing algorithm, e.g. "HS256" (HMAC-SHA256, a shared secret) or "RS256" (RSA, a public/private key pair).

Base64URL

The URL-safe Base64 variant (RFC 4648 §5) a JWT's segments are encoded with — "-"/"_" instead of "+"/"/", padding stripped.

API equivalent

This tool has no API equivalent in our service — JWT decoding isn't an IP-address fact, so there's nothing for our API to return here. The decoding above runs entirely on your device; your token is never sent anywhere. If you're looking for our IP-lookup API instead, it covers geolocation, ASN/network and threat/fraud data for an IP address:

Read the full API docs

Related tools

• All developer tools
• Base64 Encoder / Decoder
• Hash Generator (MD5/SHA-1/SHA-256)

Frequently asked questions

Does this tool verify the JWT signature?

No. It only decodes the header and payload as JSON — it never checks whether the signature is valid, so it cannot tell you whether a token is genuine. Verifying a signature requires the issuer's secret or public key, which this tool never asks for or has.

Is my token sent to your server?

No — every part of decoding happens locally in your browser's JavaScript. This page makes no network request with the token you paste, ever.

Why do I see an error decoding my token?

A valid JWT is exactly three dot-separated Base64URL segments. The most common causes are a missing or truncated segment (often from copy-pasting only part of the token), or the pasted text simply not being a JWT.

What do the "exp" and "iat" fields mean?

Both are Unix timestamps (seconds since 1970-01-01). "iat" is when the token was issued; "exp" is when it expires and a correctly-implemented verifier should start rejecting it.

Can I use this to forge a valid token?

No. Changing the decoded JSON here does nothing to a real token — a token's authenticity comes entirely from its signature, which this tool never computes or checks, and which requires a secret or private key it has no access to.

What's the difference between JWT and plain Base64?

A JWT is a specific three-part structure (header.payload.signature) using Base64URL, a URL-safe Base64 variant. Plain Base64 is just the general-purpose encoding underneath — use the Base64 tool for arbitrary text, this one for the JWT structure specifically.