DocomintJWT Decoder
Decode a JSON Web Token's header and payload in your browser.
What is a JWT Decoder?
A JWT's header and payload are just Base64URL-encoded JSON, so decoding one is mostly about convenience — reading the claims (expiry, subject, roles) inside a token your app just issued or received, without pasting it into an untrusted third-party site.
How to use the JWT Decoder
- Paste a JWT
- Its header and payload are decoded instantly, on your device
- Read the claims — this does not verify the signature
Example
Decoding a token starting eyJhbGciOiJIUzI1NiJ9... reveals a header like {"alg":"HS256","typ":"JWT"} and a payload like {"sub":"1234567890","name":"Alex","iat":1700000000} — the same claims your backend set when it issued the token.
Frequently asked questions
Is my data uploaded anywhere?
No — JWT Decoder runs entirely in your browser using JavaScript/WebAssembly. Your data is never sent to a server.
Does this verify the token's signature?
No — this decodes the header and payload only. It doesn't cryptographically verify the signature against a trusted key, so don't treat a decoded token as validated.
Why does a JWT have three parts separated by dots?
Header, payload, and signature — each Base64URL-encoded and joined with \".\". This tool decodes the first two; the third part is the signature, which requires the signing key to verify, not just decode.
Can I still decode an expired token?
Yes — decoding just reads the claims as they were encoded, including an \"exp\" timestamp in the past. It doesn't check expiry or reject the token for being old.