Header
Payload
🔒 Decoded locally. Your token is never transmitted — safe to inspect.
This tool decodes, it does not verify. A JWT’s signature can only be checked with the secret or public key, which you should never paste into a website.
Using an AI agent or a script? Call this tool as an API
AI agents and scripts can call this tool directly, to check their work or look something up, and get JSON back with the same answer this page gives. No key needed. Send the token by POST so it never appears in a web address.
POST https://digitalgreenhouse.com.au/api/tools/jwt-decoder
Content-Type: application/json
{"token": "\u2026"}token— string, required. The JWT (header.payload.signature).
The API answers from our server, and our code doesn’t store what you send. Fair-use limits apply. API guide · all endpoints (JSON) · OpenAPI
What’s inside a JWT?
A JSON Web Token has three parts separated by dots: a header (which algorithm signed it), a payload (the “claims” — who the user is, when it expires, what they can do), and a signature. The first two parts are just Base64url-encoded JSON — not encrypted. Anyone can read them, which is exactly what this tool does. Never put secrets in a JWT payload.
Common claims
exp— expiry time. We show whether it’s in the past.iat— issued-at time.nbf— not valid before this time.iss/sub/aud— issuer, subject and audience.