JWT Decoder - Decode & Verify JSON Web Tokens Online

A JSON Web Token (JWT) is a compact, URL-safe way to pass signed claims between two parties, defined in RFC 7519. You meet JWTs everywhere in modern web development: OAuth 2.0 and OpenID Connect access and ID tokens, session cookies for single-page applications, service-to-service authentication, password-reset links, and webhook signatures. Every JWT is three Base64URL-encoded segments joined by dots. The first segment is the header, a small JSON object that names the signing algorithm and token type. The second is the payload, the JSON object carrying the actual claims — who issued the token, whom it is about, and when it expires. The third segment is the signature computed over the first two. This JWT decoder splits the token, decodes the header and payload, and pretty-prints both as formatted JSON so you can read every claim at a glance. It also pulls out the registered claims from the payload — issuer, subject, audience, expiration, issued-at, not-before, and token ID — and shows the time-based ones both as raw Unix timestamps and as human-readable UTC dates. A status line tells you immediately whether the token has already expired, is not valid yet, or carries no expiry at all, which is the single most common thing developers need to check when an API suddenly starts returning 401 responses. Decoding a JWT requires no secret, because Base64URL is an encoding, not encryption: anyone who holds a token can read its contents. That is exactly why you should never put passwords or other sensitive data inside a JWT payload. What does require a key is verification. If your token was signed with the symmetric HMAC-SHA-256 algorithm, you can paste the shared secret into the optional verification section and the tool recomputes the signature with the browser's built-in Web Crypto API and compares it to the one on the token. A match proves the token was produced by someone holding that secret and has not been altered. Privacy matters when you are pasting real tokens from a production system. This tool does all of its work inside your browser tab: the token and the secret are processed in local JavaScript, never sent over the network, never stored, and never logged. Close the tab and they are gone. Note the limitations: asymmetric algorithms such as RS256 or ES256 need the issuer's public key and are not verified here, and a signature check says nothing about whether the issuer itself should be trusted — always validate issuer and audience in your backend. Typical uses include debugging login flows, checking why an access token is rejected, confirming which scopes or roles a token grants, comparing tokens from different environments, and teaching how the JWT format works.