JWT Decoder
Decode JWT tokens
This tool only decodes the token locally — it does not verify the signature. A decoded token could be forged; never trust its contents without verifying the signature server-side with the correct secret or public key.
What Is This Tool?
The JWT Decoder splits a JSON Web Token into its three segments — header, payload, and signature — and decodes the base64url-encoded header and payload back into readable JSON. It's useful for inspecting claims in a token you already have without needing a backend. All decoding happens locally in your browser; nothing is uploaded anywhere.
How to Use
Paste a JWT into the input box (three dot-separated parts).
Click Decode.
Review the decoded Header and Payload JSON, plus common date claims.
Copy either panel as needed.
Features
- Decodes header and payload as pretty-printed JSON
- Human-readable dates shown for exp/iat/nbf claims
- Shows the raw signature segment for reference
- Clear errors for malformed or non-JWT input
- Unicode-safe base64url decoding
- 100% client-side — the signature is never verified or sent anywhere
Examples
Input:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE3MzU2ODk2MDB9.dGhpc19pc19hX2Zha2Vfc2lnbmF0dXJl
Decoded payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1735689600
}
Common Use Cases
- Inspecting claims in an access token during API debugging
- Checking token expiry (exp) without a backend
- Learning the structure of JSON Web Tokens
- Confirming which algorithm (alg) and claims a token issuer used
Frequently Asked Questions
Does this tool verify the JWT signature?
No. This tool only decodes the header and payload segments; it does not verify the signature against any secret or public key. Never trust the decoded content as authentic without server-side signature verification.
Is my token uploaded anywhere?
No. All decoding happens locally in your browser using JavaScript. Nothing is sent to a server.
Why do I get an "invalid token" error?
A valid JWT must have exactly three dot-separated segments, and the first two must be valid base64url-encoded JSON. The error message will tell you which part failed.
What do the exp, iat, and nbf claims mean?
They are standard timestamp claims (in Unix seconds): exp is expiration time, iat is issued-at time, and nbf is "not before" time. This tool shows a human-readable date next to each when present.
Can I decode any JWT, regardless of algorithm?
Yes. Decoding the header and payload does not depend on the signing algorithm (HS256, RS256, etc.) since those segments are just base64url-encoded JSON, not encrypted.
Is it safe to paste a real production token here?
Decoding happens entirely in your browser and nothing is transmitted, but as a general practice avoid pasting live secrets or tokens into any tool unless you trust it and understand what it does.