JWT Decoder

Decode and inspect JWT tokens — header, payload and signature

 
 
Your files never leave your browser. Nothing is uploaded to any server. Privacy Policy

Paste any JSON Web Token to instantly decode the header and payload, view standard claims (iss, sub, exp, iat) in human-readable form, and check expiry status. Decoding runs entirely in your browser — your tokens never leave your device.

How to decode a JWT

1
Paste the token

Copy your JWT (the long string with two dots) into the input.

2
Inspect parts

Header and payload are decoded automatically as you paste.

3
Check claims

Standard claims like exp and iat are highlighted with their meaning.

🪪
Header & payload

Both segments are Base64URL-decoded and pretty-printed as JSON.

Claim formatting

Timestamps (iat, exp, nbf) are converted to readable dates and validity status.

Expiry check

See immediately whether a token is currently valid, expired or not yet active.

🔒
Local only

Decoding happens in your browser — tokens are not transmitted anywhere.

FAQ

No — verifying a signature requires the secret or public key. This tool only decodes the readable parts (header and payload).

No. Anyone can decode a JWT. Verification requires the signing key and is done by your backend.

No. JWT decoding is pure Base64URL decoding — it runs locally in your browser, never uploaded.

JWT has three parts separated by dots: header (algorithm), payload (claims) and signature. Header and payload are Base64URL-encoded JSON.

iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued-at), nbf (not-before), and jti (token ID).

More free tools