JWT Decoder
Paste a JSON Web Token to decode its header and payload, and check expiry status at a glance.
🔒 100% client-side. Nothing you paste here is sent to any server.
⚠️ Decode only. This does not verify the signature. A decoded token that looks valid could still be tampered with or forged if the signature isn't checked server-side with the correct key.
Load sample token
How JWT decoding works
A JWT is three base64url-encoded segments joined by dots: header, payload, signature. The header and payload are just base64url-encoded JSON, so decoding them is base64url decode plus JSON.parse, nothing more. The signature is not JSON and can't be meaningfully "decoded" the same way, it exists to be verified against a key, which this tool deliberately does not attempt.
Standard registered claims
| Claim | Meaning |
|---|---|
| exp | Expiration time (Unix timestamp) |
| iat | Issued-at time |
| nbf | Not-before time, token invalid until this point |
| iss | Issuer of the token |
| sub | Subject, typically a user ID |
| aud | Intended audience |
How to decode a JWT in Python
import base64, json
def decode_jwt_segment(segment: str) -> dict:
padded = segment + "=" * (-len(segment) % 4)
decoded_bytes = base64.urlsafe_b64decode(padded)
return json.loads(decoded_bytes)
header_b64, payload_b64, signature = token.split(".")
header = decode_jwt_segment(header_b64)
payload = decode_jwt_segment(payload_b64)
print(header, payload)
# To actually VERIFY a JWT (not just decode it), use a library like PyJWT:
# import jwt
# jwt.decode(token, secret_or_public_key, algorithms=["HS256"])
This tool decodes only and does not verify signatures. Never trust claims from an unverified token in a security-sensitive context. Verify signatures server-side with the correct key before acting on anything a JWT claims.