How it works
A JWT is three base64url-encoded segments separated by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. This tool splits on the dots and decodes the first two segments in your browser.
Decoding is not verifying
Reading a token tells you what it claims. It says nothing about whether those claims are genuine — that is what the signature is for, and checking it needs the signing secret or public key.
No online decoder should ever ask you for that key. A signing secret verifies every token your system issues; pasting it into a website hands over the ability to mint valid tokens. Verify on your backend, where the key already lives.
The payload is readable by anyone
Base64url is an encoding, not encryption. Anyone who holds the token can read every claim inside it, including the person you sent it to and anything that logged it along the way. The signature prevents tampering, not reading — so never place anything confidential in a JWT payload.
Common claims
iss issuer, sub subject, aud audience, exp expiry, nbf not-before,
iat issued-at, and jti a unique token id. All are optional; exp and iat
are Unix timestamps in seconds, which this tool renders as readable dates.
Limitations
Encrypted tokens (JWE) are not supported — they have five segments and their payload cannot be read without the decryption key. This tool handles signed tokens (JWS), which is what almost everything calling itself a JWT means.