JWT Decoder

Decode a JWT without sending it anywhere

A JSON Web Token is just two Base64URL-encoded JSON documents — the header and the payload — plus a signature, joined by dots. You do not need a server to read one, and you should be suspicious of any jwt decoder online that ships your token to a backend, because a live access token is a credential. This decoder runs entirely in your browser: the token is split and decoded with local JavaScript, and nothing is transmitted or logged.

Paste a token and you immediately see the decoded header (algorithm and token type), the full payload with every claim, and the raw signature. The tool also reads the standard timestamp claims and renders iat, exp, and nbf as human-readable local times, with an Active or Expired badge so you can tell at a glance whether an authentication bug is really just an expired token — one of the most common causes of mysterious 401 responses.

One honest limitation worth knowing: this is a decoder, not a verifier. Checking the signature requires the secret or public key, which this tool deliberately does not handle. Reading the claims tells you what the token says, not whether it is genuine — your server must always verify signatures itself.

How to decode a JWT

1. 1

   Paste the token

   Drop the full JWT (the three dot-separated parts starting with eyJ...) into the JWT token field. Decoding happens instantly, entirely in your browser.

2. 2

   Read the header and payload

   The decoded header shows the signing algorithm and token type; the payload card lists every claim as formatted JSON.

3. 3

   Check the expiry badge

   If the token has an exp claim, an Active or Expired badge appears on the payload, and iat, exp, and nbf are shown as readable local timestamps.

4. 4

   Copy what you need

   Each section — Header, Payload, and Signature — has its own Copy button for pasting into bug reports or test fixtures.

Frequently asked questions