Break a JWT into its header, payload and signature, with timestamps as readable dates and expiry checked. Decoding is local — the token is never sent.
Header and payload are encoded, not encrypted — anyone holding the token can read them.
Waiting for a token
Paste a JWT — with or without the Bearer prefix. It is decoded on your device and never sent anywhere.
Decoding a JWT does not verify its signature. Only the issuer’s key can prove a token is authentic, and this tool never asks for one.
Paste a token to inspect it
Registered claims are named and explained; timestamps are shown as dates.
JWT Decoder runs entirely on your device — a token is a credential and is never uploaded.
You’re on the Free plan. Compare plans
A JSON Web Token is three Base64url-encoded pieces joined by dots: a header saying how it was signed, a payload carrying the claims, and a signature over the first two. This tool splits those apart, decodes the first two and shows you what the token actually says.
The decoding matters because of a detail that surprises people: a JWT's payload is encoded, not encrypted. Anyone who holds the token can read every claim in it. That is why this tool needs no key to show you the contents — and precisely why a token should never carry anything you would mind the holder reading.
Decoding a JWT does not verify its signature. A decoded token proves only that the value was well-formed; it says nothing about whether the issuer really issued it, because anyone can construct a token with any claims they like. Verification requires the issuer's key and belongs in your server, not in a web page. This tool does not ask for keys and does not verify.
Timestamps are the other thing worth seeing plainly. The exp, nbf and iat claims are seconds since 1970, which is unreadable at a glance, so each is rendered as a UTC date and as a plain-language interval, and the token's position in its own validity window is stated at the top.
No, and that is deliberate. Verification needs the issuer's secret or public key, and a token plus its key is exactly the pair that should never be pasted into a web page. This tool decodes what the token says; whether it is authentic is a question only your server can answer.
The decoding happens entirely in your browser — nothing is sent to a server, logged or stored. Bear in mind that a live token is a credential wherever it goes, so the ordinary precautions still apply: prefer an expired one, and treat a token pasted into any other site as compromised.
Because Base64url is an encoding, not encryption. It exists to make bytes safe to put in a URL, not to hide them. If a claim needs to stay secret, it does not belong in a JWT payload.
The exp claim is earlier than your computer's current time. A correctly implemented server will reject the token, though the check is the server's to make — an expired token is not automatically refused by anything else.
A token declaring no signature at all. It can be altered by anyone who holds it, and any server that accepts one has a serious vulnerability. The tool marks these explicitly.
A five-segment token is a JSON Web Encryption value, where the payload really is encrypted. Its contents cannot be read without the decryption key, so no decoder can show them to you.
