About the JWT Decoder
The JWT decoder displays the JSON header and payload contained in a JSON Web Token. Decoding runs locally and helps inspect claims during development, but it deliberately does not verify the token's signature or trustworthiness.
How to use this tool
Paste a compact JWT with its dot-separated header, payload, and signature segments. Decode it to view the JSON fields in the first two segments. Check registered time claims such as exp, nbf, and iat as Unix seconds, and inspect issuer, audience, and subject only in the context of the system that created the token. Use the relevant server or identity-provider library when you need actual validation.
How to read the result
The header commonly names a signing algorithm and key identifier. The payload contains claims, which are statements made by the issuer. The signature segment protects integrity only when it is verified using an allowed algorithm and trusted key. Readable claims are not secrets: standard JWT segments use Base64url encoding, not encryption. An attacker can alter decoded text unless the receiving application rejects the resulting signature.
Limits and privacy
This tool does not verify signatures, key trust, issuer, audience, expiration, not-before time, nonce, token type, or revocation. Never treat a decoded token as valid based on its appearance. Avoid pasting production bearer tokens into tools you do not control; although this decoder works locally, tokens can also remain in clipboard history or browser memory. The entered token is not sent to buffer.lol.
Common questions
- Does decoding a JWT verify it?
- No. Verification requires a trusted key, an explicitly allowed algorithm, and validation of claims such as issuer, audience, and time bounds.
- Are JWT payloads encrypted?
- Ordinary signed JWTs are only encoded and can be read by anyone holding the token. Encrypted JWT formats require separate JWE handling.