JWT Decoder
Read the header and claims inside a JSON Web Token. This tool decodes content only — it does not verify the signature.
Your data stays on your device
This tool decodes JWT content only. It does not verify the token signature or authenticity.
Do not paste production tokens into this or any other online tool. A JWT grants access for as long as it is valid — treat it like a password and use an expired or test token here. Decoding happens in your browser and nothing is transmitted, but the habit matters more than any one tool’s promise.
JWT
- characters
- 0
- lines
- 0
- size
- 0 B
About this tool
A JWT is three Base64url segments separated by dots: a header describing the algorithm, a payload of claims, and a signature. The first two are merely encoded, not encrypted, so anyone holding the token can read them.
That is exactly why decoding must not be confused with verification. A decoded token tells you what it claims to be; only checking the signature against the issuer key tells you whether those claims can be trusted. This page does the former and deliberately not the latter.
How to use this tool
- Paste a JWT — three Base64url segments separated by dots.
- Read the decoded header and payload, shown as formatted JSON.
- Check the timestamp panel, which renders exp, iat and nbf as readable dates.
- Use the expiry indicator to see whether the token is currently within its validity window.
Key features
- Header and payload decoded and pretty-printed separately
- Base64url handling including missing padding
- exp, iat and nbf rendered as local and UTC dates
- Expiry status computed against your current clock
- Registered claims annotated with their standard meaning
- Malformed tokens reported by segment so you know which part is broken
Example
Input — JWT
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIiwiZXhwIjoxNzY3MjI1NjAwfQ.sigOutput — JSON
header { "alg": "HS256" }
payload { "sub": "1", "exp": 1767225600 }
exp → 2026-01-01 00:00:00 UTC (signature NOT verified)Good to know
- This tool decodes JWT content only. It does not verify the token signature or authenticity.
- Encrypted tokens (JWE) cannot be decoded without the key and are reported as such.
- Expiry is evaluated against your device clock, which may differ from the server that issued the token.
Frequently asked questions
Does this verify my token?
No. Verification requires the issuer signing key and must happen on your server. A decoded payload proves nothing about authenticity.
Should I paste a production token here?
No. Treat a JWT like a password — it grants access for as long as it is valid. Use an expired or test token when you need to inspect a structure.
Why can everyone read the payload?
Because a standard JWT is signed, not encrypted. The signature protects integrity, not confidentiality, so never put secrets in the claims.
What does alg: none mean?
An unsigned token. Accepting one is a well-known vulnerability; a verifier must always require the expected algorithm rather than trusting the header.
Your data stays on your device
Your data is processed locally in your browser and is not uploaded to our server. This page keeps working after you go offline, because there is nothing to send.