Decode JSON Web Tokens Instantly
Paste a JWT to view its header, payload, and claims — right in your browser.
About the JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe string used to represent claims between two parties. This tool splits a JWT into its header, payload, and signature, decodes the Base64URL-encoded header and payload, and displays them as readable JSON — along with a summary of standard claims like issuer, subject, audience, and expiry.
Features:
- Instant client-side decoding — no upload, no server round-trip
- Human-readable summary of standard claims (iss, sub, aud, exp, iat, nbf)
- Automatic expiry check with a clear EXPIRED / VALID UNTIL badge
- Privacy-first — your token never leaves your browser
How to decode a JWT
- Paste your JWT into the input box
- The header and payload are decoded automatically as you type
- Review the claims summary to check issuer, subject, and expiry
- Copy the decoded header or payload JSON with one click
Frequently Asked Questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format made of three Base64URL-encoded parts — header, payload, and signature — separated by dots, commonly used for authentication and information exchange.
Does this tool verify the token's signature?
No. This tool only decodes the header and payload so you can read their contents — it does not check the signature against a secret or public key. See the note above the signature section for details.
What do the exp, iat, and nbf claims mean?
iat is when the token was issued, nbf is the earliest time it becomes valid, and exp is when it expires. All three are Unix timestamps (seconds since 1970), which this tool converts into a readable date.
Is it safe to paste a real production token here?
Yes, in the sense that decoding happens entirely in your browser and the token is never sent anywhere — but treat any real token as a secret regardless of where you paste it, since anyone who has it can potentially use it until it expires.
Why can't I read the signature part?
The signature isn't meant to be human-readable — it's a cryptographic value used to verify the token wasn't tampered with. This tool shows it as raw text but doesn't attempt to decode or verify it.
Why does 'decoded' not mean 'verified'?
Decoding just reverses the Base64URL encoding to reveal the JSON underneath — anyone can do that without knowing the signing key. Verifying proves the token was issued by a trusted party and hasn't been altered, which requires the secret or public key and is a job for your backend, not this tool.
Privacy
Your token is decoded entirely in your browser using JavaScript. It is never uploaded, transmitted, or stored anywhere — including LazyParadise's own servers.