JWT Decoder
Signature not verified — this tool only decodes the token, it does not check the signature.
What is JWT Decoder
A JWT (JSON Web Token) is a compact, URL-safe token used to carry claims between two parties, most often for authentication and authorization. It has three Base64URL-encoded parts separated by dots: header, payload and signature. This decoder splits the token and shows the decoded header and payload as readable JSON, plus human-friendly dates for the standard time claims. Everything runs in your browser — the token is never sent anywhere.
How to use
- Paste your JWT into the input field.
- Read the decoded header and payload shown as formatted JSON.
- Check the decoded timestamps (iat, exp, nbf) and whether the token has expired.
- Copy the signature segment if you need it for verification elsewhere.
When to use it
Getting a 401 on a login you thought was working? Paste the JWT here, open the payload, and check the exp claim: if it shows an 'Expired' badge with a past date, the token just timed out rather than being malformed. From there you can also confirm the iat and nbf values line up with what your API expects.
Frequently asked questions
Does this tool verify the JWT signature?
No. It only decodes the token to show its contents. Verifying the signature requires the secret or public key, which should never be entered into a web page. Use a server-side library for verification.
Is my token sent to a server?
No. Decoding happens entirely in your browser with JavaScript. The token never leaves your device, which makes it safe to inspect tokens locally.
Why does the payload look readable if JWTs are 'encrypted'?
A standard JWT is encoded, not encrypted. Anyone can Base64URL-decode the header and payload, so never put secrets in a JWT payload. The signature only guarantees the token was not tampered with.
Can I share this tool with my inputs pre-filled?
Yes. The URL updates automatically as you type. Copy it from the address bar or use the Share button — anyone who opens the link will see your exact inputs ready to go.
Related tools
JWT Generator and Signer
Create and sign a JWT online with HS256, HS384, or HS512 and a secret. Instant and fully private in your browser.
AES Text Decryption
Decrypt AES-256 encrypted text with your password in your browser. Free, private, and fully offline. No data leaves your device.
AES Text Encryption
Encrypt text with a password using AES-256 in your browser. Free, private, and fully offline. Nothing is sent to a server.