Developer Tools
JWT Decoder
Decode a JSON Web Token to inspect its header and payload.
Free foreverRuns in your browserNo sign-up
The signature is not verified. This tool only decodes the token, so never trust a JWT based on decoding alone. Everything runs in your browser.
About the JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64URL parts: a header, a payload of claims, and a signature.
Paste a token and this tool decodes the header and payload so you can inspect the claims, and it shows the issued, not-before and expiry times in a readable format.
Decoding happens entirely in your browser and the token is never uploaded, which matters because tokens often contain sensitive session data.
Key features
- Decodes header and payload instantly
- Human-readable iat, nbf and exp times
- Handles standard Base64URL encoding
- Runs locally, nothing is uploaded
How to use
- 1Paste your JWT into the box.
- 2The decoded header and payload appear immediately.
- 3Check the readable timestamps for issue and expiry times.
Frequently asked questions
- Does this verify the token's signature?
- No. It only decodes the token so you can read it. A decoded token is not proof of authenticity, so never trust a JWT based on decoding alone.
- Is my token sent to a server?
- No. Decoding happens entirely in your browser, so your token and its claims never leave your device.
- Why is the payload readable if it is 'encoded'?
- JWTs are encoded, not encrypted. The header and payload are just Base64URL text, so anyone can read them. Sensitive data should not be placed in a JWT payload.