JWT Decoder
Paste a JSON Web Token and view its header and payload instantly — all in your browser, nothing uploaded to any server.
Header
Payload
🔒 100% private — the token never leaves your browser. This tool does NOT verify the signature, it only decodes the content.
-
1. Paste your JWT
Type or paste the full token into the box.
-
2. It's decoded instantly
You'll see the header and payload as readable JSON, and whether the token is expired.
-
3. Copy what you need
One click on each panel to copy the header or payload.
How it works
A JWT has three dot-separated parts: header, payload and signature. The first two are Base64-encoded (not encrypted), so anyone can read them — this tool simply decodes them and shows them as readable JSON. If the payload includes an "exp" field, we compare that date to the current time and warn you if the token has already expired.
What this tool does NOT do
It doesn't verify the signature. Verifying the signature requires the issuer's secret (HMAC) or public (RSA/ECDSA) key, which this tool never has or asks for. It only decodes the content, useful for debugging tokens during development.
Frequently asked questions
Is my token uploaded to a server?
No. All decoding happens in your browser, with JavaScript. Your token never leaves your device.
Does this tool verify the JWT signature?
No. A JWT has three parts: header, payload and signature. This tool only decodes and shows the header and payload (which aren't encrypted, just Base64-encoded), but it doesn't verify whether the signature is valid — that requires the issuer's secret or public key, which this tool never has or requests.
What does it mean when the token is expired?
If the payload includes the "exp" (expiration) field, we compare that date to your device's current time and warn you if it has already passed. An expired token is normally rejected by the server that receives it, even though its content remains readable.