JWT Decoder

Is it safe to paste a real production JWT here?

The decoding happens entirely in your browser, nothing is transmitted anywhere. That said, treat any JWT as sensitive: it may contain user IDs, roles, or scopes. Prefer using an expired or test token when possible.

Why can this tool read the payload without my secret key?

By design, JWT payloads are only Base64URL-encoded, not encrypted, meaning anyone who intercepts a token can read its contents. The signature is what prevents tampering, not the payload's readability. Never put sensitive data in a JWT payload for this reason.

What does the "exp" claim actually mean?

"exp" is a Unix timestamp (seconds since Jan 1, 1970) marking when the token expires. Most authentication failures with a valid-looking token are simply an expired "exp" claim, which this tool checks automatically.

Why does my JWT show an error when decoding?

Usually because the pasted string is missing a segment (should have exactly 2 dots), has extra whitespace or line breaks, or is not actually a JWT (some APIs return opaque tokens that only look similar).

Can I use this to build a JWT for testing, not just decode one?

No, this tool is read-only decoding. Constructing a valid signed JWT requires your actual signing secret and algorithm, which should happen server-side or in your own trusted tooling, never in a public browser tool.