A JSON Web Token (JWT) is a compact token format made of three Base64URL parts (header.payload.signature), used e.g. for authentication. Header and payload are only encoded, not encrypted – so readable by anyone.

Is the signature verified?

No. This decoder shows header and payload but does NOT verify the signature – that would require the issuer's secret key. The output therefore says nothing about the token's authenticity.

Yes. The token is decoded entirely in your browser and never sent to a server. Since JWTs can be sensitive, still handle foreign/production tokens with care.

JWT Decoder – Decode a JSON Web Token online

Paste token

My IP JWT Decoder Base64 JSON Hash

What is a JSON Web Token (JWT)?

A JWT consists of three dot-separated parts: header (algorithm & type), payload (the claims – e.g. user ID sub, issuer iss, expiry exp) and the signature. Header and payload are merely Base64URL-encoded – not encrypted. Anyone holding the token can read its contents; the signature only protects against tampering.

This decoder splits the token, decodes header and payload and converts the time claims (iat, nbf, exp) into readable dates. The signature is not verified, as that would require the secret key. Everything runs locally in your browser – the token never leaves your device.