JWT Decoder
Paste a JSON Web Token to read its header, payload and claims.
Decoding a JWT does not verify its signature. Anything shown here is only what the token claims. Never trust it until your server has verified the signature with the right key.
Informational only. These dates are read from the token and are not validated.
🔒 Your data is processed locally in your browser and is never uploaded to our servers.
How it works
A JWT is three Base64URL parts separated by dots: a header (algorithm and type), a payload (the claims) and a signature. KadiTools decodes the first two into formatted JSON and shows the signature exactly as it appears in the token.
Security notes
The payload of a normal JWT is not secret: anyone holding the token can read it. Only the signature proves the token was issued by someone holding the key, and that check must be done by your server. Be careful pasting production tokens into any website; this page keeps them in your browser, but a live token can still be misused if it leaks elsewhere.
FAQ
Can I rely on the expiry date shown?
Reading exp from the payload only shows what the token says, and your device's clock may differ from the server's. Real validation belongs on the server.
Can it decode encrypted JWTs (JWE)?
No. Encrypted tokens have five parts and can't be read without the key.