ChistStudioWhat this tool does
A JSON Web Token is three Base64URL-encoded segments joined by dots: a header describing the signing algorithm, a payload carrying the actual claims (like user ID or expiry time), and a signature that proves the token hasn't been tampered with. This tool decodes the first two segments back into readable JSON so you can inspect exactly what a token contains, which is invaluable when debugging authentication flows.
What decoding does not tell you
Decoding is not the same as verifying. Anyone can decode a JWT's header and payload without knowing the signing secret — that's by design, since JWTs are meant to be readable, just not forgeable. This tool deliberately does not attempt signature verification, since that would require the issuer's secret or public key, which you should never paste into a third-party site.
Frequently asked questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used to represent claims between two parties, commonly for authentication. It consists of three Base64URL-encoded parts separated by dots: a header, a payload, and a signature.
Does decoding a JWT verify it is valid?
No. Decoding only reveals the header and payload, which are Base64-encoded but not encrypted. Verifying a JWT requires checking its signature against the issuer's key, which this tool does not do.
Is it safe to paste a production JWT into a decoder?
A JWT's payload is already readable by anyone holding the token, so decoding itself reveals nothing new. Still, avoid pasting tokens into tools you don't trust, since a malicious site could log and reuse a still-valid token. This tool decodes entirely client-side and never transmits your token.
What is typically inside a JWT payload?
Common claims include sub (subject/user ID), iat (issued-at time), exp (expiration time), iss (issuer), and any custom claims the issuing service adds, such as roles or permissions.