JWT decoder
Decode a JSON Web Token's header and payload, with expiry and claims. All in the browser: the token never leaves your device.
Genuinely free. No sign-up, no email, no limits, no cookies. We don't store the URL you analyse.
Paste a token to decode it.
What this tool cannot see
Decoding, not verifying: we read the header and payload but don't validate the signature, which requires the secret key and should be checked server-side. Don't paste other people's production tokens.
What a JWT is
A JSON Web Token is a string in three dot-separated parts (header, payload and signature), each Base64url-encoded. Header and payload are encoded, not encrypted: anyone can read them, which is exactly what this tool does. The signature guarantees the token hasn't been tampered with, and is verified with the key, server-side.
Other handy tools are the Base64 converter and the Unix timestamp converter (handy for reading the «exp» claim).
Frequently asked questions
›Is my token sent to a server?
No. Decoding happens entirely in your browser, in JavaScript: the token never leaves your device and isn't stored anywhere. That's why a client-side tool is safer than one that sends the token to a third-party server, since a JWT contains potentially sensitive data.
›Do you verify the token's signature too?
No, and we say so clearly: decoding is not verifying. The signature requires the secret (or public) key used to sign the token, which shouldn't be handled by an online tool. Here you read the header and payload; signature validity should be checked server-side, where the key lives.
›How do I tell if a token is expired?
The tool reads the «exp» (expiration) claim and compares it with the current time, showing whether the token is valid or expired. It also reads «nbf» (not before) and «iat» (issued at) and converts them to readable dates.