Decode a JWT token
Paste a JWT token to inspect its decoded header and payload, which is handy for debugging authentication. 100% local processing in your browser (WebAssembly).
Warning: the signature is NOT verified. This tool only decodes the token's contents (header and payload) so you can inspect them. It in no way proves that the token is authentic. Never trust a token based on its decoding alone: cryptographic verification must always be done on the server.
How it works
A JWT (JSON Web Token) is made up of three parts separated by dots: header.payload.signature. The header and payload are simply Base64URL-encoded, not encrypted, which means anyone can see their contents without a key or password. That's exactly the typical use of this tool: paste the authentication token returned by an API to quickly check what it actually contains (expiration date exp, user role, ID, and so on) while debugging, without writing code or setting up a backend.
Why does the token still “work” after I edited it by hand?
Because this tool doesn't verify the signature: it simply decodes the Base64URL of the header and payload, just like any other inspection tool. A properly configured server will recompute the signature from the contents and compare it with the one provided in the token. A payload modified without the right secret key will be rejected at that point, even though it decodes perfectly here.
What does the exp field in the payload mean?
exp (“expiration”) is a Unix timestamp (seconds since 1970) after which the token must be considered expired. A server that follows the JWT standard will reject any request using a token once the current time exceeds this value, regardless of whether its signature is valid.
Privacy: decoding happens entirely in your browser via WebAssembly. The contents of your tokens, even if they contain sensitive data, never leave your device.