JWT Decoder

Decode JWT header and payload locally and safely.

Signature is NOT verified. This tool only decodes the token locally in your browser: it never checks the signature against a secret, and nothing is sent anywhere.

JWT Token

How it works

Paste a JWT (the three dot-separated Base64 sections).
The header and payload are decoded and shown as readable JSON.
Check standard claims like expiry (exp) and issued-at (iat).
Nothing is sent anywhere. Decoding is local.

What people use it for

Inspecting the claims inside a token while debugging auth.
Checking whether a token has expired.
Reading the algorithm and headers of a JWT.

Good to know

This decodes a token; it does not verify the signature: that needs the signing secret or public key, which is a server-side concern.
A JWT payload is only Base64-encoded, not encrypted, so never treat anything inside it as secret.

Frequently asked questions

Does this verify the token is valid?

It decodes the header and payload and flags expiry, but it does not cryptographically verify the signature. That requires the secret/key and should be done server-side. Treat the decoded contents as unverified.

Is it safe to paste a real token here?

The token is decoded entirely in your browser and never transmitted, so it does not leave your device. Still, tokens are sensitive. This being local is exactly why it is the safer place to inspect one.

Why can I read the payload without a password?

A JWT payload is Base64-encoded, not encrypted. That is by design (the signature protects integrity, not confidentiality) so never put secrets in a JWT.

Related tools