JWT Decoder
Runs in your browser, nothing is uploaded. Your input is not saved.Decode a JSON Web Token and inspect its header, claims, and expiry.
About this tool
A JWT is three Base64URL segments separated by dots: a header, a payload of claims, and a signature. This tool decodes the header and payload so you can read them, and turns exp, iat, and nbf into readable dates. It does not verify the signature, so a decoded token is not proof that the token is genuine.
Questions
Is it safe to paste a real token here?
Decoding happens entirely in your browser and the token is never put in the page URL. Even so, treat live tokens as secrets and prefer expired or test tokens when you can.
Does this verify the signature?
No. Verifying needs the secret or public key and should happen on your server. Anyone can create a token that decodes cleanly, so never trust claims you have not verified.
Why can I read the payload without a key?
A signed JWT is encoded, not encrypted. The signature only detects tampering. Do not put secrets in the payload.