JWT Decoder
Paste a JSON Web Token to decode its header and payload and check standard claims like issued-at and expiry. Decoding happens locally, so your token is never sent anywhere.
To decode a JWT, paste the token and its header, payload and claims (like expiry) are decoded instantly in your browser — the token is never uploaded.
Decoded locally — the signature is not verified. Never paste secrets.
Zero Server Uploads
Files process in local RAM
Instant WASM Speed
No waiting queues or lags
Unlimited Batching
Convert files without limits
How to use JWT Decoder
- 1Paste your JSON Web Token (header.payload.signature).
- 2The header and payload are decoded and pretty-printed.
- 3Check standard claims like issued-at and expiry.
- 4Copy the decoded header or payload as needed.
How it works
Paste a JWT and its three parts — header, payload and signature — are split and the header and payload are base64url-decoded and pretty-printed. Standard time claims (iat, nbf, exp) are shown in human-readable form, including whether the token has expired.
Everything runs in your browser, so tokens containing sensitive data are never uploaded — unlike many online JWT tools.
Decoding vs verifying
This tool decodes a JWT so you can read it. It does not verify the signature, because verification requires the secret or public key — which you should never paste into a website.
Frequently Asked Questions
Does this verify the JWT signature?
No. It only decodes the header and payload so you can inspect them. Verifying the signature needs the secret or key and should be done in your own trusted environment.
Is it safe to paste my token here?
The token is decoded entirely in your browser and never uploaded. Still, treat production tokens carefully and avoid pasting long-lived secrets anywhere.
Why can't I see the payload as readable text?
JWT payloads are base64url-encoded JSON, not encrypted. This tool decodes that encoding so you can read the claims.