How to decode a JWT locally — and why it matters

A JSON Web Token (JWT) looks like random characters, but it is just three pieces of base64url-encoded text joined by dots: a header, a payload of claims, and a signature. Anyone holding the token can read the first two parts. That is exactly why pasting a live access token into a website that sends it to a server is risky: until it expires, that token is the user's login.

A worked example

Here is a token signed with HS256 and the throwaway secret example-secret-do-not-use:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEwNDIiLCJuYW1lIjoiQWRhIExvdmVsYWNlIiwicm9sZSI6ImVkaXRvciIsImlhdCI6MTc2NzIyNTYwMCwiZXhwIjoxNzY3MjI5MjAwfQ.mgFhVvh3U2UEhhllGNSG9rhf6Cn7vwSw_h-QjrCVTG0

Decoding the first part gives the header, and the second part the payload:

{ "alg": "HS256", "typ": "JWT" }

{
  "sub": "user-1042",
  "name": "Ada Lovelace",
  "role": "editor",
  "iat": 1767225600,
  "exp": 1767229200
}

iat (issued at) and exp (expires) are Unix timestamps in seconds: 1767225600 is 1 January 2026 00:00 UTC and 1767229200 is one hour later, so this token was valid for exactly one hour.

Decode it without it leaving your machine

1. Open the JWT Decoder and paste the token. It is decoded as you type, in the page itself — no request is made.
2. Read the header and payload as formatted JSON. Time claims (iat, nbf, exp) are shown as dates, with an EXPIRED flag when the token has run out.
3. To check the signature of an HS256 token, paste the secret into the verification field. With the example above and example-secret-do-not-use, the signature verifies; change one character of the payload and it no longer does.

Prefer the terminal? This Python one-liner decodes the payload (base64url needs its padding restored first):

python3 -c "import sys,base64,json; p=sys.argv[1].split('.')[1]; print(json.dumps(json.loads(base64.urlsafe_b64decode(p + '=' * (-len(p) % 4))), indent=2))" YOUR_TOKEN

Decoding is not verifying

Anyone can create a token with "role": "admin" in the payload. What makes a token trustworthy is the signature, checked with the right key on the server. Use decoding to debug — "why is this request rejected?", "which scopes does this token have?", "has it expired?" — and never to make security decisions in client code.

• HS256 tokens are signed with a shared secret; whoever has the secret can both create and verify tokens.
• RS256 / ES256 tokens are signed with a private key and verified with a public key. The decoder shows them but verifies only HS256.
• A header with "alg": "none" means unsigned. Servers must reject such tokens.