JWT Decoder
Paste a JSON Web Token to decode its header and payload and check expiry — entirely in your browser. Your token is never sent to a server.
Reading a token is easy. Trusting it is the hard part.
Decoding a JWT is trivial — a JWT is signed, not encrypted. The real work is issuing, validating signatures, binding to a domain/device, and revoking access at the edge for every request. That is what Traffic Orchestrator does: drop-in license & API-key validation on Cloudflare's edge, 12 SDKs, Stripe-ready.
Start free →How a JWT is structured
A JSON Web Token has three base64url-encoded parts separated by dots: header.payload.signature. The header names the signing algorithm; the payload holds the claims (subject, expiry, issued-at, custom data); the signature proves the token was not tampered with. The header and payload are not encrypted — anyone can decode them — so never put secrets in a JWT payload, and always verify the signature server-side or at the edge before trusting a token.
Frequently asked questions
Is my token sent anywhere?
No. Decoding happens entirely in your browser — the token is never transmitted or logged. You can disconnect from the internet and it still works. Never paste production secrets into any online tool, but this one is safe to inspect tokens with because nothing leaves your device.
Does this verify the signature?
This tool decodes the header and payload (which are only base64url-encoded, not encrypted) and checks expiry. It does not verify the cryptographic signature, because that requires your secret or public key — which should never be pasted into a web tool. Verify signatures server-side or at the edge.
Why can anyone read my JWT payload?
A JWT is signed, not encrypted. The header and payload are base64url — anyone can decode them. Never put secrets in a JWT payload. The signature only proves the token was not tampered with, not that its contents are private.