JWT Decoder

Decodes the header and payload of a JSON Web Token from base64url and renders the standard claims in a readable form. Decoding happens entirely in your browser — the token is not sent to a server. The signature is not verified; that requires a secret key.

Input
Paste a token in header.payload.signature form. The token is not sent to a server.

Decoded Token

Paste a JWT above; the sections are decoded instantly.

Frequently Asked Questions

Is the token I paste sent to a server?

No. Decoding happens entirely in your browser with JavaScript; the token is not sent to any server and is not stored anywhere. When you close the page, no trace remains.

Does this tool verify the token signature?

No. This tool only decodes the header and payload sections. Verifying the signature requires the issuer's secret key (HMAC such as HS256) or public key (RS256/ES256), and handing that secret to a web tool is not safe. Verify the signature server-side with the JwtBearer middleware.

Is the data inside a JWT encrypted?

No. base64url is only an encoding, not encryption — anyone can decode the payload. Do not put passwords, personal data or secrets in a JWT. If confidentiality is needed, use JWE (encrypted JWT) or keep sensitive data outside the token.

What do the exp, iat and nbf claims mean?

All three are NumericDate values: the number of seconds since 1 January 1970 UTC. exp is the token's expiration moment; iat is when it was issued; nbf is when it starts being valid. This tool converts all three to readable dates and shows whether the token has expired.

How do I verify a JWT in .NET?

Add the Microsoft.AspNetCore.Authentication.JwtBearer package and configure AddAuthentication().AddJwtBearer(...) with TokenValidationParameters: ValidateIssuer, ValidateAudience, ValidateLifetime and IssuerSigningKey. The middleware checks the signature, issuer and lifetime for you — do not decode the signature by hand.