What is a JWT?
A JSON Web Token is a compact way to carry claims between parties. Most tokens you see in APIs use the compact JWS form: three base64url segments separated by dots — header, payload, and signature.
JWT Decoder — Decode Header and Payload Locally
Inspect algorithm, issuer, audience, and expiry claims in your browser. Tokens are not uploaded.
Analysis is performed locally in your browser. Pasted tokens are not uploaded to the server. Loading tool…
JWT structure
The header usually names the algorithm and token type. The payload holds claims such as iss, sub, aud, iat, nbf, and exp. The third segment is a signature over the first two — this tool displays it but does not verify it.
JWT vs JWE
JWE (encrypted) tokens use five segments. This decoder supports three-segment JWS only and will say when a token looks like JWE instead of attempting a misleading decode.
Decode vs verify
Decoding reads the JSON inside the token. Verification proves a trusted key produced the signature. A token can decode cleanly and still be forged, expired, or intended for another audience.
Understanding exp, nbf, and iat
These claims are Unix timestamps. The claims helper shows UTC and your local timezone. An expired exp value is highlighted; it does not prove the token was ever valid for your API.
Security mistakes to avoid
Do not paste live session tokens into any online decoder you do not control. Do not treat alg: none or a successful decode as authenticity. Do not skip audience and issuer checks in application code.
FAQs
Does this tool verify signatures?
No. Status text always makes that clear. Bring your own verification in the service that accepts the token.
Is my token sent to the server?
No. The JWT Decoder runs in JavaScript after the page loads. Pasted tokens are not posted to WordPress or a third party.
Why does alg: none still decode?
Because decode only reads JSON. The tool discloses alg: none so you can treat it as a warning, not a pass.
Need help securing authentication and API authorization?
I help teams design practical auth controls, review token handling, and harden public APIs.