JWT Decoder
Free online JWT decoder. Inspect the header, payload, and signature of any JSON Web Token. Decodes only — no signature verification. 100% in your browser.
Paste a JWT here (header.payload.signature), or
About this tool
This tool decodes JWTs locally in your browser — no token is sent anywhere. Signatures are not verified; if you need to verify, do that server-side with your secret/public key.
About JWT Decoder
Paste a JSON Web Token to split it into its three parts and read the decoded header and payload as formatted JSON. You can see the signing algorithm, the claims, and timestamp fields such as issued-at and expiry so you can confirm a token carries the data you expect.
The token is decoded in your browser and never sent to a server, which matters because tokens often grant access to accounts. Note that this tool only decodes; it does not verify the signature, so a decoded token is not proof that the token is genuine or untampered.
Frequently asked questions
- Does this verify the token signature?
- No. It decodes the header and payload only. Verifying the signature requires the secret or public key, which the tool does not handle.
- Is it safe to paste a real token here?
- Decoding happens locally and nothing is uploaded, but treat tokens as sensitive and avoid pasting them on shared machines.
- How do I read the expiry?
- The exp claim is a Unix timestamp in seconds; the tool shows it so you can compare it against the current time.