JWT Decoder
Decode JSON Web Tokens — header, payload and claims. 100% local: your token never leaves the browser. (Signature is not verified here.)
Decode a JWT (JSON Web Token) and inspect its header, payload and signature details. Claims are pretty-printed with timestamps converted to readable dates, and expiring tokens are flagged. Everything is parsed locally — your token never leaves the page.
Standard: RFC 7519 (JWT). Tokens are base64url-encoded and decoded locally.
How to use the JWT Decoder
- Paste the JWT into the input.
- Header and payload are decoded and pretty-printed instantly.
- Check the exp claim and expiry warning at a glance.
Frequently asked questions
What is a JWT?
A JSON Web Token — a compact, signed token used for authentication and data exchange, made of header.payload.signature parts.
Can I decode a JWT without the secret?
Yes. JWTs are base64url-encoded, not encrypted, so anyone can read the payload. Only the signature needs the secret to verify.
Is it safe to paste my JWT here?
Everything is decoded locally in your browser — nothing is sent anywhere. Still, never share tokens with anyone.
Why does it say my token is expired?
The exp claim is in the past. Tokens can expire while you are looking at them, so this tool re-checks the time.