JWT Decoder
Paste a JSON Web Token to see its header and payload, decoded instantly on your device. This only decodes the token — it does not verify the signature.
Paste a JWT to begin.
This tool only decodes — it cannot confirm the token is authentic or untampered. Verifying a signature requires the secret or public key, which never belongs in a browser tool.
Does this tool verify the JWT is genuine?
No. It only decodes the header and payload from Base64URL — it does not check the signature. Verifying a signature needs the issuer's secret or public key, which should never be pasted into a browser tool. Use your backend or auth library for real verification.
Is my token sent anywhere?
No. Decoding happens entirely in your browser using JavaScript's built-in Base64 and JSON support — nothing is uploaded, logged or stored. Still, treat JWTs like passwords: don't paste tokens from production systems into tools you don't fully trust.
Why do exp/iat/nbf show as dates?
Those standard claims store Unix timestamps (seconds since 1970). This tool converts them to a readable UTC date and flags whether an exp claim has already passed.