JWT Decoder
Paste a JSON Web Token and read its header and payload as formatted JSON — with expiry times translated to human dates. Fully offline.
803 views
Could not decode — paste a three-part, dot-separated JWT.
Signature is NOT verified: decoding successfully does not mean the token is authentic.
See What Is Inside a Token
A JWT is three Base64URL-encoded parts — header, payload, signature — joined by dots. Paste one and the tool decodes the header (algorithm, type) and payload (claims) into pretty-printed JSON. Time claims like exp, iat and nbf are additionally shown as human-readable dates, with an at-a-glance badge telling you whether the token is currently expired.
Decoding happens entirely in your browser — nothing is sent anywhere, which matters because tokens are credentials. Note what this tool deliberately does not do: it cannot verify the signature (that requires the secret or public key), so "decodes fine" never means "is authentic".
Frequently Asked Questions
Does decoding verify that the token is valid?
No — decoding only reads the contents. Signature verification requires the signing secret or public key and belongs on your server. Anyone can craft a token with any payload; only the signature proves authenticity.
Is it safe to paste a real production token here?
The tool never transmits the token — decoding is local. Still, treat production tokens like passwords: prefer expired or test tokens when debugging in shared environments.
Why does my token fail to decode?
Check that you copied all three dot-separated parts and no line breaks were introduced. Encrypted tokens (JWE, five parts) cannot be read without the key — this tool handles signed JWS tokens, the common kind.
Similar Tools
Report a Problem
JWT Decoder