JWT Decoder
What it is: A JWT is the token you often get after logging in — it Base64-encodes user info and an expiry. Decode it to see the contents here.
When to use: When debugging login/auth and you want to see what a token stores and when it expires.
Everything runs locally in your browser — nothing is uploaded.
FAQ
What are the three parts of a JWT?
A JWT consists of three Base64url-encoded segments joined by dots: Header (algorithm info), Payload (claims), and Signature. The first two are only encoded, not encrypted — anyone can decode them, so never put sensitive plaintext in the payload.
Can this tool verify the signature?
No. Verifying the signature requires the server-side secret (an HMAC key or RSA/EC public key). This tool only decodes and displays the contents; the token is processed entirely in your browser and never uploaded anywhere.