JWT Decoder
Paste a JSON Web Token to see its decoded header and payload, with expiry and issued-at times made readable. Decoding happens in your browser — the token is never transmitted.
private This tool runs entirely in your
browser. Nothing you enter is sent to our server or anyone else.
Reading a token safely
A JWT has three dot-separated parts: header, payload and signature. The first two are just Base64url-encoded JSON — this tool decodes them so you can read the claims (sub, exp, iat, iss…). It does not verify the signature, and it cannot, because that needs the secret or public key. Decoding is not validation: never trust a token's contents without checking its signature server-side. Because the token can grant access, we decode it locally and never send it anywhere.