ToolToUse

Developer

JWT Decoder

Paste a JSON Web Token to read its header and payload. Timestamps are shown as readable dates and expiry is checked against your clock.

Developer

JWT decoder

Local only
Your token never leaves your browser

Decoding is done locally. Even so, avoid pasting production tokens into any online tool you do not control.

What a JWT contains

A JSON Web Token has three dot-separated parts: a header describing the signing algorithm, a payload of claims, and a signature. The first two are base64url-encoded JSON — readable by anyone, so never put secrets in them.

Signature verification

This tool decodes but deliberately does not verify the signature, because verification needs your secret or public key. Treat decoded contents as untrusted until your server has verified the token.

Good to know

Frequently asked questions

Does this verify the signature?

No. Verification requires your signing key, which should never be pasted into a website. Verify server-side instead.

Is my token uploaded?

No. Decoding happens entirely in your browser.

Why are exp and iat shown as dates?

They are Unix timestamps in seconds; the tool converts them to your local time for readability.

Is a JWT encrypted?

Not usually. A standard JWT is signed, not encrypted, so anyone holding it can read the payload.

Keep exploring

View all

Developer

UUID Generator

Generate random version 4 UUIDs in bulk and copy or download them.

Open tool
Popular

Developer

JSON Formatter & Validator

Pretty-print, minify and validate JSON with clear error details.

Open tool

Developer

Base64 Encoder & Decoder

Encode text to Base64 and decode it back, safely in your browser.

Open tool