Site Tools

JWT Decoder

Ad Space

Tokens are decoded only in your browser. Never paste production or personal tokens into online tools you do not control.

Ad Space

The JWT Decoder reveals what is inside a JSON Web Token without sending it anywhere. Paste a token and the tool splits it into its three parts, Base64URL-decodes the header and payload, and pretty-prints both as JSON. It automatically interprets the standard time claims — issued-at (iat), not-before (nbf) and expiry (exp) — as human-readable dates and warns you clearly when a token has expired. Remember that a JWT payload is only encoded, not encrypted, so anyone can read it; this tool never verifies the signature and runs entirely in your browser, so your tokens stay on your device.

How to Use the JWT Decoder

  1. Paste a JWT (header.payload.signature) into the input box.
  2. Read the decoded header and payload, formatted as JSON.
  3. Check the expiry status and the human-readable iat/nbf/exp dates.

Benefits and Use Cases

  • Quickly inspect token claims and expiry while debugging authentication.
  • Understand exactly what data an app stores in its tokens.
  • Decodes locally in your browser — your token is never sent to a server.

FAQ

Does it verify the signature?

No. It only decodes the header and payload (which are Base64URL, not encrypted). It does not validate the signature.

Is it safe to paste a token?

Decoding is local to your browser, but never paste real production or personal tokens into tools you do not fully trust.

Why is the payload readable?

A JWT payload is only Base64URL-encoded, so anyone can read it. Sensitive data should never be stored in a JWT.