JWT Decoder
Paste a JWT to see its header and payload decoded and formatted.
Decoding isn't verifying
A JWT is just Base64 text — anyone can read its content without any key, exactly like this tool does. Decoding a JWT doesn't mean validating its authenticity: only whoever holds the key or certificate it was signed with can do that, by checking the third segment's signature against the header and payload.
Privacy
The token is decoded in your browser and isn't stored anywhere or sent to Numelto or any server — not even the signature, which also isn't processed.
What you'll see in a JWT
The payload's dates (iat, exp) are Unix timestamps: convert them with the timestamp converter. You can format the decoded JSON with the JSON formatter.
| Part | Content |
|---|---|
| Header | The token's algorithm and type |
| Payload | Data ("claims"): subject, issuer, expiration (exp)… |
| Signature | Not processed: only whoever has the key can verify it |