Using the JWT decoder
Paste a JSON Web Token to break it into its header, payload and signature, with the registered claims explained and timestamps shown in plain language. Everything runs in your browser – nothing you paste is uploaded or stored, so it is safe for tokens, keys and private data.
What is a JWT?
A JSON Web Token is three Base64URL-encoded parts joined by dots: a header (the signing algorithm and token type), a payload (the claims) and a signature. It is widely used to carry a signed, tamper-evident set of claims about a user or session between services.
Is the signature checked?
No. Verifying a signature needs the issuer’s secret (for HMAC) or public key (for RSA/ECDSA), which this tool does not have and should not be given. It decodes and displays the token so you can inspect it; treat the contents as unverified.
Is my token sent anywhere?
No. Decoding happens entirely in your browser with JavaScript. The token is never uploaded, logged or stored – but a JWT is still a credential, so take the same care with it you would a password.
What else can this tool do?
The same converter also handles base64, url, html entities, hex, binary, morse code and rot13 / caesar cipher. Pick a format from the menu without leaving the page.
Is any of this encryption?
No. Encoding changes how data is represented so it can travel safely through a channel; it does not protect it. Anyone can reverse Base64, percent-encoding, hex or ROT13. For a one-way fingerprint use the hash generator; to check JSON you have decoded, use the JSON formatter.