JWT Decoder

Paste a JSON Web Token to decode its header and payload, and check expiry status at a glance.

🔒 100% client-side. Nothing you paste here is sent to any server.
⚠️ Decode only. This does not verify the signature. A decoded token that looks valid could still be tampered with or forged if the signature isn't checked server-side with the correct key.

Load sample token

How JWT decoding works

A JWT is three base64url-encoded segments joined by dots: header, payload, signature. The header and payload are just base64url-encoded JSON, so decoding them is base64url decode plus JSON.parse, nothing more. The signature is not JSON and can't be meaningfully "decoded" the same way, it exists to be verified against a key, which this tool deliberately does not attempt.

Standard registered claims

ClaimMeaning
expExpiration time (Unix timestamp)
iatIssued-at time
nbfNot-before time, token invalid until this point
issIssuer of the token
subSubject, typically a user ID
audIntended audience

How to decode a JWT in Python

import base64, json def decode_jwt_segment(segment: str) -> dict: padded = segment + "=" * (-len(segment) % 4) decoded_bytes = base64.urlsafe_b64decode(padded) return json.loads(decoded_bytes) header_b64, payload_b64, signature = token.split(".") header = decode_jwt_segment(header_b64) payload = decode_jwt_segment(payload_b64) print(header, payload) # To actually VERIFY a JWT (not just decode it), use a library like PyJWT: # import jwt # jwt.decode(token, secret_or_public_key, algorithms=["HS256"])

This tool decodes only and does not verify signatures. Never trust claims from an unverified token in a security-sensitive context. Verify signatures server-side with the correct key before acting on anything a JWT claims.

Related Tools