מפענח JWT

A JSON Web Token has three parts separated by dots: a Base64URL-encoded header, a Base64URL-encoded payload, and a signature. This decoder splits and decodes the first two parts instantly in your browser, so you can read what a token actually contains.

The most common use is inspecting a token an API returned: who issued it (iss), when it expires (exp), what permissions it carries (scope or roles), and whether it has already expired.

The tool takes the header and payload segments and decodes their Base64URL contents back into readable JSON. Nothing is sent anywhere: the split and decode happen locally the moment you paste a token.

The expiry is shown in readable local time, not a raw Unix timestamp, so you can see at a glance whether the token is still valid. The same applies to other time claims like iat and nbf, which become dates you can actually interpret.

This tool decodes and displays, it does not verify the signature against a secret key. Anyone can read a JWT payload without a key, because only the signature is protected, not the contents.

For signature verification you need the signing secret or public key, which should never be entered into a browser-based tool. Do not paste secrets here.

The token never leaves your device. All decoding runs in your browser, so nothing you paste is uploaded or stored.