JSON Web Tokens (JWT) are the standard format for authentication tokens in modern web apps and APIs. A JWT is three Base64Url-encoded parts joined by dots: a header (algorithm and type), a payload (claims like user ID, roles, and expiry), and a signature. When login breaks or an API returns 401, decoding the token is usually the fastest way to see why.
This decoder splits a JWT and pretty-prints its header and payload, including human-readable dates for the iat (issued at) and exp (expiry) claims. Decoding happens entirely in your browser — the token is never transmitted — and no secret key is needed because the payload is encoded, not encrypted.
How to Use This Tool
- Paste the full JWT (the long string with two dots).
- Header and payload are decoded and formatted instantly.
- Check the exp claim to see whether the token has expired.
- Verify claims like sub, role, and aud match what your app expects.
Frequently Asked Questions
Why can I read a JWT without the secret key?
Because JWTs are signed, not encrypted. Base64Url encoding is trivially reversible by design — anyone can read the payload. The secret key is only needed to verify or forge the signature, which proves the token was issued by your server and not tampered with.
Should I put sensitive data in a JWT payload?
No. Treat the payload as public: never include passwords, personal data, or secrets. Store only what the server needs to identify the session — a user ID, roles, and expiry. If a token leaks in a log or URL, its contents are exposed.
What do iat, exp, and nbf mean?
They are timestamp claims in Unix seconds: iat is when the token was issued, exp is when it expires, and nbf (not before) is the earliest moment it is valid. Most authentication bugs trace back to an expired exp or a clock mismatch between servers.