What is a JWT?
A JSON Web Token is a compact token format often used to carry identity or authorization claims between systems. JWTs are commonly seen in API authentication, sessions and service-to-service communication.
JWT structure
A JWT has three dot-separated base64url segments: header, payload and signature. This tool decodes those segments locally so you can inspect their contents.
Header
The header usually describes the token type and signing algorithm, such as typ and alg.
Payload
The payload contains claims. These may include registered claims like issuer, subject, audience and expiration, plus custom application data.
Signature
The signature is used by a verifier to check that the token was signed with the expected key or secret and has not been altered. This tool displays the signature segment but does not verify it.
JWT decoding vs verification
Decoding only reads base64url text. Verification requires the correct signing algorithm, key material and validation rules. Do not trust a JWT simply because it decodes successfully.
Expiration claims
JWT time claims such as exp, nbf and iat are NumericDate values in seconds. The decoder shows readable dates and marks expired tokens where possible.
Privacy
Your token never leaves your browser. This JWT decoder does not submit tokens to Laravel, log them, save them in localStorage or sessionStorage, write cookies, or call an API.
FAQ
Does this JWT decoder upload my token?
No. Decoding happens locally in your browser.
Does decoding prove a JWT is valid?
No. A decoded token still needs signature verification and claim validation before it can be trusted.
Can it decode Unicode payloads?
Yes. The decoder uses UTF-8 decoding for base64url segments.